deps: tar@7.5.22 (#9814)

## Summary

Updates the bundled `tar` dependency from `7.5.11` to `7.5.22` on the
npm 10 release branch.

All production dependency paths now resolve to `tar@7.5.22`.

## Testing

- `node . run dependencies --ignore-scripts`
- `node . ls tar --all --omit=dev`
- `node . audit --omit=dev --json` reports no `tar` vulnerability
- `node . test --ignore-scripts` reports only existing Windows
environment failures; no tar-related failures

Fixes #9801

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3da238b5-ee4e-45ef-a43d-577d015a769b

Author: martinrrm

node_modules/tar/dist/commonjs/create.js

@@ -28,7 +28,7 @@ const createFile = (opt, files) => {
         stream.on('close', res);
         p.on('error', rej);
     });
-    addFilesAsync(p, files);
+    addFilesAsync(p, files).catch(er => p.emit('error', er));
     return promise;
 };
 const addFilesSync = (p, files) => {
@@ -48,8 +48,7 @@ const addFilesSync = (p, files) => {
     p.end();
 };
 const addFilesAsync = async (p, files) => {
-    for (let i = 0; i < files.length; i++) {
-        const file = String(files[i]);
+    for (const file of files) {
         if (file.charAt(0) === '@') {
             await (0, list_js_1.list)({
                 file: node_path_1.default.resolve(String(p.cwd), file.slice(1)),
@@ -72,7 +71,7 @@ const createSync = (opt, files) => {
 };
 const createAsync = (opt, files) => {
     const p = new pack_js_1.Pack(opt);
-    addFilesAsync(p, files);
+    addFilesAsync(p, files).catch(er => p.emit('error', er));
     return p;
 };
 exports.create = (0, make_command_js_1.makeCommand)(createFileSync, createFile, createSync, createAsync, (_opt, files) => {

node_modules/tar/dist/commonjs/get-write-flag.js

@@ -15,15 +15,18 @@ const fs_1 = __importDefault(require("fs"));
 const platform = process.env.__FAKE_PLATFORM__ || process.platform;
 const isWindows = platform === 'win32';
 /* c8 ignore start */
-const { O_CREAT, O_TRUNC, O_WRONLY } = fs_1.default.constants;
+const { O_CREAT, O_NOFOLLOW, O_TRUNC, O_WRONLY } = fs_1.default.constants;
 const UV_FS_O_FILEMAP = Number(process.env.__FAKE_FS_O_FILENAME__) ||
     fs_1.default.constants.UV_FS_O_FILEMAP ||
     0;
 /* c8 ignore stop */
 const fMapEnabled = isWindows && !!UV_FS_O_FILEMAP;
 const fMapLimit = 512 * 1024;
 const fMapFlag = UV_FS_O_FILEMAP | O_TRUNC | O_CREAT | O_WRONLY;
-exports.getWriteFlag = !fMapEnabled ?
-    () => 'w'
-    : (size) => (size < fMapLimit ? fMapFlag : 'w');
+const noFollowFlag = !isWindows && typeof O_NOFOLLOW === 'number' ?
+    O_NOFOLLOW | O_TRUNC | O_CREAT | O_WRONLY
+    : null;
+exports.getWriteFlag = noFollowFlag !== null ? () => noFollowFlag
+    : !fMapEnabled ? () => 'w'
+        : (size) => (size < fMapLimit ? fMapFlag : 'w');
 //# sourceMappingURL=get-write-flag.js.map

node_modules/tar/dist/commonjs/header.js

@@ -41,6 +41,7 @@ exports.Header = void 0;
 const node_path_1 = require("node:path");
 const large = __importStar(require("./large-numbers.js"));
 const types = __importStar(require("./types.js"));
+const notNegative = (n) => n === undefined || n < 0 ? undefined : n;
 class Header {
     cksumValid = false;
     needPax = false;
@@ -78,23 +79,44 @@ class Header {
         if (!buf || !(buf.length >= off + 512)) {
             throw new Error('need 512 bytes for header');
         }
-        this.path = ex?.path ?? decString(buf, off, 100);
-        this.mode = ex?.mode ?? gex?.mode ?? decNumber(buf, off + 100, 8);
-        this.uid = ex?.uid ?? gex?.uid ?? decNumber(buf, off + 108, 8);
-        this.gid = ex?.gid ?? gex?.gid ?? decNumber(buf, off + 116, 8);
-        this.size = ex?.size ?? gex?.size ?? decNumber(buf, off + 124, 12);
+        // Decode the typeflag (independent of any pending PAX/GNU extended header)
+        // up front so we can tell whether THIS block is itself an intermediary
+        // extension header (PAX `x`/`g`, GNU long-name `L`, GNU long-link `K`).
+        // Per POSIX pax, a PAX extended header describes the *next file entry*, not
+        // the extension headers that may sit between it and that file. Applying the
+        // pending PAX overrides (notably `size`) to an intervening `L`/`K`/`x`/`g`
+        // header desynchronizes the stream relative to other tar implementations
+        // and enables tar interpretation-conflict / file-smuggling attacks.
+        const t = decString(buf, off + 156, 1);
+        const isNormalFS = types.normalFsTypes.has(t);
+        const exForFields = isNormalFS ? ex : undefined;
+        const gexForFields = isNormalFS ? gex : undefined;
+        this.path = exForFields?.path ?? decString(buf, off, 100);
+        this.mode =
+            exForFields?.mode ??
+                gexForFields?.mode ??
+                decNumber(buf, off + 100, 8);
+        this.uid =
+            exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
+        this.gid =
+            exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
+        this.size = notNegative(exForFields?.size ??
+            gexForFields?.size ??
+            decNumber(buf, off + 124, 12));
         this.mtime =
-            ex?.mtime ?? gex?.mtime ?? decDate(buf, off + 136, 12);
+            exForFields?.mtime ??
+                gexForFields?.mtime ??
+                decDate(buf, off + 136, 12);
         this.cksum = decNumber(buf, off + 148, 12);
         // if we have extended or global extended headers, apply them now
         // See https://github.com/npm/node-tar/pull/187
-        // Apply global before local, so it overrides
-        if (gex)
-            this.#slurp(gex, true);
-        if (ex)
-            this.#slurp(ex);
+        // Apply global before local, so it overrides. Never slurp the pending
+        // extended-header fields onto an intermediary extension header.
+        if (gexForFields)
+            this.#slurp(gexForFields, true);
+        if (exForFields)
+            this.#slurp(exForFields);
         // old tar versions marked dirs as a file with a trailing /
-        const t = decString(buf, off + 156, 1);
         if (types.isCode(t)) {
             this.#type = t || '0';
         }
@@ -110,17 +132,26 @@ class Header {
             this.size = 0;
         }
         this.linkpath = decString(buf, off + 157, 100);
-        if (buf.subarray(off + 257, off + 265).toString() ===
-            'ustar\u000000') {
+        if (buf.subarray(off + 257, off + 265).toString() === 'ustar\u000000') {
             /* c8 ignore start */
             this.uname =
-                ex?.uname ?? gex?.uname ?? decString(buf, off + 265, 32);
+                exForFields?.uname ??
+                    gexForFields?.uname ??
+                    decString(buf, off + 265, 32);
             this.gname =
-                ex?.gname ?? gex?.gname ?? decString(buf, off + 297, 32);
+                exForFields?.gname ??
+                    gexForFields?.gname ??
+                    decString(buf, off + 297, 32);
             this.devmaj =
-                ex?.devmaj ?? gex?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
+                exForFields?.devmaj ??
+                    gexForFields?.devmaj ??
+                    decNumber(buf, off + 329, 8) ??
+                    0;
             this.devmin =
-                ex?.devmin ?? gex?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
+                exForFields?.devmin ??
+                    gexForFields?.devmin ??
+                    decNumber(buf, off + 337, 8) ??
+                    0;
             /* c8 ignore stop */
             if (buf[off + 475] !== 0) {
                 // definitely a prefix, definitely >130 chars.
@@ -133,10 +164,8 @@ class Header {
                     this.path = prefix + '/' + this.path;
                 }
                 /* c8 ignore start */
-                this.atime =
-                    ex?.atime ?? gex?.atime ?? decDate(buf, off + 476, 12);
-                this.ctime =
-                    ex?.ctime ?? gex?.ctime ?? decDate(buf, off + 488, 12);
+                this.atime = ex?.atime ?? gex?.atime ?? decDate(buf, off + 476, 12);
+                this.ctime = ex?.ctime ?? gex?.ctime ?? decDate(buf, off + 488, 12);
                 /* c8 ignore stop */
             }
         }
@@ -159,6 +188,7 @@ class Header {
             // null/undefined values are ignored.
             return !(v === null ||
                 v === undefined ||
+                (k === 'size' && Number(v) < 0) ||
                 (k === 'path' && gex) ||
                 (k === 'linkpath' && gex) ||
                 k === 'global');
@@ -180,17 +210,12 @@ class Header {
         const prefix = split[1];
         this.needPax = !!split[2];
         this.needPax = encString(buf, off, 100, path) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 100, 8, this.mode) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 108, 8, this.uid) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 116, 8, this.gid) || this.needPax;
-        this.needPax =
-            encNumber(buf, off + 124, 12, this.size) || this.needPax;
-        this.needPax =
-            encDate(buf, off + 136, 12, this.mtime) || this.needPax;
-        buf[off + 156] = this.#type.charCodeAt(0);
+        this.needPax = encNumber(buf, off + 100, 8, this.mode) || this.needPax;
+        this.needPax = encNumber(buf, off + 108, 8, this.uid) || this.needPax;
+        this.needPax = encNumber(buf, off + 116, 8, this.gid) || this.needPax;
+        this.needPax = encNumber(buf, off + 124, 12, this.size) || this.needPax;
+        this.needPax = encDate(buf, off + 136, 12, this.mtime) || this.needPax;
+        buf[off + 156] = Number(this.#type.codePointAt(0));
         this.needPax =
             encString(buf, off + 157, 100, this.linkpath) || this.needPax;
         buf.write('ustar\u000000', off + 257, 8);
@@ -205,12 +230,10 @@ class Header {
         this.needPax =
             encString(buf, off + 345, prefixSize, prefix) || this.needPax;
         if (buf[off + 475] !== 0) {
-            this.needPax =
-                encString(buf, off + 345, 155, prefix) || this.needPax;
+            this.needPax = encString(buf, off + 345, 155, prefix) || this.needPax;
         }
         else {
-            this.needPax =
-                encString(buf, off + 345, 130, prefix) || this.needPax;
+            this.needPax = encString(buf, off + 345, 130, prefix) || this.needPax;
             this.needPax =
                 encDate(buf, off + 476, 12, this.atime) || this.needPax;
             this.needPax =

node_modules/tar/dist/commonjs/index.min.js

@@ -59,19 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            if (m !== undefined) {
-                ret = m;
-            }
-            else {
-                ret = mapHas((0, path_1.dirname)(file), root);
-            }
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
@@ -114,7 +117,7 @@ const listFileSync = (opt) => {
                 node_fs_1.default.closeSync(fd);
                 /* c8 ignore next */
             }
-            catch (er) { }
+            catch { }
         }
     }
 };

node_modules/tar/dist/commonjs/list.js

@@ -12,12 +12,7 @@ const makeCommand = (syncFile, asyncFile, syncNoFile, asyncNoFile, validate) =>
             cb = entries;
             entries = undefined;
         }
-        if (!entries) {
-            entries = [];
-        }
-        else {
-            entries = Array.from(entries);
-        }
+        entries = !entries ? [] : Array.from(entries);
         const opt = (0, options_js_1.dealias)(opt_);
         validate?.(opt, entries);
         if ((0, options_js_1.isSyncFile)(opt)) {
@@ -28,9 +23,7 @@ const makeCommand = (syncFile, asyncFile, syncNoFile, asyncNoFile, validate) =>
         }
         else if ((0, options_js_1.isAsyncFile)(opt)) {
             const p = asyncFile(opt, entries);
-            // weirdness to make TS happy
-            const c = cb ? cb : undefined;
-            return c ? p.then(() => c(), c) : p;
+            return cb ? p.then(() => cb(), cb) : p;
         }
         else if ((0, options_js_1.isSyncNoFile)(opt)) {
             if (typeof cb === 'function') {
@@ -45,9 +38,7 @@ const makeCommand = (syncFile, asyncFile, syncNoFile, asyncNoFile, validate) =>
             return asyncNoFile(opt, entries);
             /* c8 ignore start */
         }
-        else {
-            throw new Error('impossible options??');
-        }
+        throw new Error('impossible options??');
         /* c8 ignore stop */
     }, {
         syncFile,

node_modules/tar/dist/commonjs/make-command.js

@@ -72,7 +72,7 @@ const mkdir = (dir, opt, cb) => {
 };
 exports.mkdir = mkdir;
 const mkdir_ = (base, parts, mode, unlink, cwd, created, cb) => {
-    if (!parts.length) {
+    if (parts.length === 0) {
         return cb(null, created);
     }
     const p = parts.shift();
@@ -83,8 +83,7 @@ const onmkdir = (part, parts, mode, unlink, cwd, created, cb) => (er) => {
     if (er) {
         node_fs_1.default.lstat(part, (statEr, st) => {
             if (statEr) {
-                statEr.path =
-                    statEr.path && (0, normalize_windows_path_js_1.normalizeWindowsPath)(statEr.path);
+                statEr.path = statEr.path && (0, normalize_windows_path_js_1.normalizeWindowsPath)(statEr.path);
                 cb(statEr);
             }
             else if (st.isDirectory()) {
@@ -113,7 +112,7 @@ const onmkdir = (part, parts, mode, unlink, cwd, created, cb) => (er) => {
 };
 const checkCwdSync = (dir) => {
     let ok = false;
-    let code = undefined;
+    let code;
     try {
         ok = node_fs_1.default.statSync(dir).isDirectory();
     }
@@ -159,14 +158,14 @@ const mkdirSync = (dir, opt) => {
     }
     const sub = (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.relative(cwd, dir));
     const parts = sub.split('/');
-    let created = undefined;
+    let created;
     for (let p = parts.shift(), part = cwd; p && (part += '/' + p); p = parts.shift()) {
         part = (0, normalize_windows_path_js_1.normalizeWindowsPath)(node_path_1.default.resolve(part));
         try {
             node_fs_1.default.mkdirSync(part, mode);
             created = created || part;
         }
-        catch (er) {
+        catch {
             const st = node_fs_1.default.lstatSync(part);
             if (st.isDirectory()) {
                 continue;

node_modules/tar/dist/commonjs/mkdir.js

@@ -7,6 +7,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizeWindowsPath = void 0;
 const platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
 exports.normalizeWindowsPath = platform !== 'win32' ?
-    (p) => p
-    : (p) => p && p.replace(/\\/g, '/');
+    (p) => String(p)
+    : (p) => String(p).replaceAll(/\\/g, '/');
 //# sourceMappingURL=normalize-windows-path.js.map