@@ -20,13 +20,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
2020} ) : function ( o , v ) {
2121 o [ "default" ] = v ;
2222} ) ;
23- var __importStar = ( this && this . __importStar ) || function ( mod ) {
24- if ( mod && mod . __esModule ) return mod ;
25- var result = { } ;
26- if ( mod != null ) for ( var k in mod ) if ( k !== "default" && Object . prototype . hasOwnProperty . call ( mod , k ) ) __createBinding ( result , mod , k ) ;
27- __setModuleDefault ( result , mod ) ;
28- return result ;
29- } ;
23+ var __importStar = ( this && this . __importStar ) || ( function ( ) {
24+ var ownKeys = function ( o ) {
25+ ownKeys = Object . getOwnPropertyNames || function ( o ) {
26+ var ar = [ ] ;
27+ for ( var k in o ) if ( Object . prototype . hasOwnProperty . call ( o , k ) ) ar [ ar . length ] = k ;
28+ return ar ;
29+ } ;
30+ return ownKeys ( o ) ;
31+ } ;
32+ return function ( mod ) {
33+ if ( mod && mod . __esModule ) return mod ;
34+ var result = { } ;
35+ if ( mod != null ) for ( var k = ownKeys ( mod ) , i = 0 ; i < k . length ; i ++ ) if ( k [ i ] !== "default" ) __createBinding ( result , mod , k [ i ] ) ;
36+ __setModuleDefault ( result , mod ) ;
37+ return result ;
38+ } ;
39+ } ) ( ) ;
3040var __importDefault = ( this && this . __importDefault ) || function ( mod ) {
3141 return ( mod && mod . __esModule ) ? mod : { "default" : mod } ;
3242} ;
@@ -56,6 +66,7 @@ const SYMLINK = Symbol('symlink');
5666const HARDLINK = Symbol ( 'hardlink' ) ;
5767const UNSUPPORTED = Symbol ( 'unsupported' ) ;
5868const CHECKPATH = Symbol ( 'checkPath' ) ;
69+ const STRIPABSOLUTEPATH = Symbol ( 'stripAbsolutePath' ) ;
5970const MKDIR = Symbol ( 'mkdir' ) ;
6071const ONERROR = Symbol ( 'onError' ) ;
6172const PENDING = Symbol ( 'pending' ) ;
@@ -239,6 +250,35 @@ class Unpack extends parse_js_1.Parser {
239250 this . emit ( 'end' ) ;
240251 }
241252 }
253+ // return false if we need to skip this file
254+ // return true if the field was successfully sanitized
255+ [ STRIPABSOLUTEPATH ] ( entry , field ) {
256+ const path = entry [ field ] ;
257+ if ( ! path || this . preservePaths )
258+ return true ;
259+ const parts = path . split ( '/' ) ;
260+ if ( parts . includes ( '..' ) ||
261+ /* c8 ignore next */
262+ ( isWindows && / ^ [ a - z ] : \. \. $ / i. test ( parts [ 0 ] ?? '' ) ) ) {
263+ this . warn ( 'TAR_ENTRY_ERROR' , `${ field } contains '..'` , {
264+ entry,
265+ [ field ] : path ,
266+ } ) ;
267+ // not ok!
268+ return false ;
269+ }
270+ // strip off the root
271+ const [ root , stripped ] = ( 0 , strip_absolute_path_js_1 . stripAbsolutePath ) ( path ) ;
272+ if ( root ) {
273+ // ok, but triggers warning about stripping root
274+ entry [ field ] = String ( stripped ) ;
275+ this . warn ( 'TAR_ENTRY_INFO' , `stripping ${ root } from absolute ${ field } ` , {
276+ entry,
277+ [ field ] : path ,
278+ } ) ;
279+ }
280+ return true ;
281+ }
242282 [ CHECKPATH ] ( entry ) {
243283 const p = ( 0 , normalize_windows_path_js_1 . normalizeWindowsPath ) ( entry . path ) ;
244284 const parts = p . split ( '/' ) ;
@@ -267,25 +307,9 @@ class Unpack extends parse_js_1.Parser {
267307 } ) ;
268308 return false ;
269309 }
270- if ( ! this . preservePaths ) {
271- if ( parts . includes ( '..' ) ||
272- /* c8 ignore next */
273- ( isWindows && / ^ [ a - z ] : \. \. $ / i. test ( parts [ 0 ] ?? '' ) ) ) {
274- this . warn ( 'TAR_ENTRY_ERROR' , `path contains '..'` , {
275- entry,
276- path : p ,
277- } ) ;
278- return false ;
279- }
280- // strip off the root
281- const [ root , stripped ] = ( 0 , strip_absolute_path_js_1 . stripAbsolutePath ) ( p ) ;
282- if ( root ) {
283- entry . path = String ( stripped ) ;
284- this . warn ( 'TAR_ENTRY_INFO' , `stripping ${ root } from absolute path` , {
285- entry,
286- path : p ,
287- } ) ;
288- }
310+ if ( ! this [ STRIPABSOLUTEPATH ] ( entry , 'path' ) ||
311+ ! this [ STRIPABSOLUTEPATH ] ( entry , 'linkpath' ) ) {
312+ return false ;
289313 }
290314 if ( node_path_1 . default . isAbsolute ( entry . path ) ) {
291315 entry . absolute = ( 0 , normalize_windows_path_js_1 . normalizeWindowsPath ) ( node_path_1 . default . resolve ( entry . path ) ) ;
0 commit comments