+30
-13
lines changedFilter options
+30
-13
lines changed Original file line number Diff line number Diff line change
@@ -48,6 +48,7 @@ const crypto = require('crypto')
48 48
const getFlag = require('./get-write-flag.js')
49 49
const platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform
50 50
const isWindows = platform === 'win32'
51 +
const DEFAULT_MAX_DEPTH = 1024
51 52 52 53
// Unlinks on Windows are not atomic.
53 54
//
@@ -181,6 +182,12 @@ class Unpack extends Parser {
181 182
this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ?
182 183
process.getgid() : null
183 184 185 +
// prevent excessively deep nesting of subfolders
186 +
// set to `Infinity` to remove this restriction
187 +
this.maxDepth = typeof opt.maxDepth === 'number'
188 +
? opt.maxDepth
189 +
: DEFAULT_MAX_DEPTH
190 + 184 191
// mostly just for testing, but useful in some cases.
185 192
// Forcibly trigger a chown on every entry, no matter what
186 193
this.forceChown = opt.forceChown === true
@@ -238,13 +245,13 @@ class Unpack extends Parser {
238 245
}
239 246 240 247
[CHECKPATH] (entry) {
248 +
const p = normPath(entry.path)
249 +
const parts = p.split('/')
250 + 241 251
if (this.strip) {
242 -
const parts = normPath(entry.path).split('/')
243 252
if (parts.length < this.strip) {
244 253
return false
245 254
}
246 -
entry.path = parts.slice(this.strip).join('/')
247 - 248 255
if (entry.type === 'Link') {
249 256
const linkparts = normPath(entry.linkpath).split('/')
250 257
if (linkparts.length >= this.strip) {
@@ -253,11 +260,21 @@ class Unpack extends Parser {
253 260
return false
254 261
}
255 262
}
263 +
parts.splice(0, this.strip)
264 +
entry.path = parts.join('/')
265 +
}
266 + 267 +
if (isFinite(this.maxDepth) && parts.length > this.maxDepth) {
268 +
this.warn('TAR_ENTRY_ERROR', 'path excessively deep', {
269 +
entry,
270 +
path: p,
271 +
depth: parts.length,
272 +
maxDepth: this.maxDepth,
273 +
})
274 +
return false
256 275
}
257 276 258 277
if (!this.preservePaths) {
259 -
const p = normPath(entry.path)
260 -
const parts = p.split('/')
261 278
if (parts.includes('..') || isWindows && /^[a-z]:\.\.$/i.test(parts[0])) {
262 279
this.warn('TAR_ENTRY_ERROR', `path contains '..'`, {
263 280
entry,
@@ -2,7 +2,7 @@
2 2
"author": "GitHub Inc.",
3 3
"name": "tar",
4 4
"description": "tar for node",
5 -
"version": "6.2.0",
5 +
"version": "6.2.1",
6 6
"repository": {
7 7
"type": "git",
8 8
"url": "https://github.com/isaacs/node-tar.git"
@@ -151,7 +151,7 @@
151 151
"spdx-expression-parse": "^3.0.1",
152 152
"ssri": "^10.0.5",
153 153
"supports-color": "^9.4.0",
154 -
"tar": "^6.2.0",
154 +
"tar": "^6.2.1",
155 155
"text-table": "~0.2.0",
156 156
"tiny-relative-date": "^1.3.0",
157 157
"treeverse": "^3.0.0",
@@ -14808,9 +14808,9 @@
14808 14808
}
14809 14809
},
14810 14810
"node_modules/tar": {
14811 -
"version": "6.2.0",
14812 -
"resolved": "https://registry.npmjs.org/tar/-/tar-6.2.0.tgz",
14813 -
"integrity": "sha512-/Wo7DcT0u5HUV486xg675HtjNd3BXZ6xDbzsCUZPt5iw8bTQ63bP0Raut3mvro9u+CUyq7YQd8Cx55fsZXxqLQ==",
14811 +
"version": "6.2.1",
14812 +
"resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
14813 +
"integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
14814 14814
"inBundle": true,
14815 14815
"dependencies": {
14816 14816
"chownr": "^2.0.0",
@@ -16153,7 +16153,7 @@
16153 16153
"minimatch": "^9.0.4",
16154 16154
"npm-package-arg": "^11.0.1",
16155 16155
"pacote": "^17.0.4",
16156 -
"tar": "^6.2.0"
16156 +
"tar": "^6.2.1"
16157 16157
},
16158 16158
"devDependencies": {
16159 16159
"@npmcli/eslint-config": "^4.0.0",
@@ -114,7 +114,7 @@
114 114
"spdx-expression-parse": "^3.0.1",
115 115
"ssri": "^10.0.5",
116 116
"supports-color": "^9.4.0",
117 -
"tar": "^6.2.0",
117 +
"tar": "^6.2.1",
118 118
"text-table": "~0.2.0",
119 119
"tiny-relative-date": "^1.3.0",
120 120
"treeverse": "^3.0.0",
@@ -54,7 +54,7 @@
54 54
"minimatch": "^9.0.4",
55 55
"npm-package-arg": "^11.0.1",
56 56
"pacote": "^17.0.4",
57 -
"tar": "^6.2.0"
57 +
"tar": "^6.2.1"
58 58
},
59 59
"templateOSS": {
60 60
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4