7zip-native 0.0.10 → 0.0.14

package/README.md

@@ -90,6 +90,7 @@ Each entry includes:
 | --- | --- | --- |
 | `id` | `number` | Stable ID within this opened archive |
 | `path` | `string` | Entry path, using `/` separators |
+| `extractedPath` | `string` | Relative output path after platform-specific filename normalization; Windows-invalid characters are replaced |
 | `size` | `bigint` | Uncompressed size |
 | `compressedSize` | `bigint` | Compressed size |
 | `isDirectory` | `boolean` | Whether the entry is a directory |
@@ -192,7 +193,7 @@ It also accepts these options:
 - `compressionLevel`: Integer from 0 to 9; defaults to 5 and applies only to ZIP and 7z. TAR is uncompressed; WIM uses the upstream handler's default settings.
 - `overwrite`: Defaults to `false`. When `true`, an existing output file is replaced after the new archive has been written.
 
-Duplicate, unsafe, or conflicting internal paths are rejected. The output is first written to a temporary file beside the destination, then installed atomically, so an existing file is preserved if archive creation fails. Archive creation runs in the bounded native worker pool and does not launch a 7-Zip executable.
+Duplicate, absolute, or traversal paths are rejected, but platform-supported filename characters such as trailing spaces are preserved in the archive-internal path. The output is first written to a temporary file beside the destination, then installed atomically, so an existing file is preserved if archive creation fails. Archive creation runs in the bounded native worker pool and does not launch a 7-Zip executable.
 
 ### Extracting to a folder
 
@@ -221,7 +222,7 @@ await archive.extractToFolder('./unpacked', {
 
 Each native extraction call receives a batch of entry IDs and output paths. The addon queues disk writes asynchronously while 7-Zip continues extracting later entries; `onExtract` runs after that file's queued writes have completed and the file is closed. File contents are not streamed through Node.js or Electron. The `extractToFolder()` promise resolves after all `onExtract` callbacks have run.
 
-On Windows only, invalid filename characters (`< > : | ? * "`) and trailing dots/spaces in each destination component are replaced with `_`; selectors and entry metadata remain unchanged. Unsafe archive paths, path collisions, symlinked destination components, and symlink or non-file targets are rejected. Archive links are written as regular file data; the API does not create symbolic or hard links. If extraction fails partway through, files already written (or partially written) may remain in the destination.
+On Windows only, unsupported filename characters (including control characters), trailing dots/spaces in each destination component, and reserved device names are normalized for the output path; selectors and entry metadata remain unchanged. On Linux and macOS, platform-supported filename characters are preserved. Unsafe archive paths, path collisions, symlinked destination components, and symlink or non-file targets are rejected. Archive links are written as regular file data; the API does not create symbolic or hard links. If extraction fails partway through, files already written (or partially written) may remain in the destination.
 
 ### Concurrency
 

package/dist/index.cjs

@@ -66,32 +66,49 @@ function safeEntrySegments(entryPath) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', 'Archive entry path contains a null byte');
     }
     const normalized = entryPath.replace(/\\/g, '/');
-    if (normalized.startsWith('/') || /^[a-zA-Z]:/.test(normalized)) {
+    if (normalized.startsWith('/') || /^[a-zA-Z]:\//.test(normalized)) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', `Archive entry path is absolute: ${entryPath}`);
     }
     const segments = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
-    if (segments.length === 0 || segments.some(segment => segment === '..'
-        || segment.includes(':')
-        || /[. ]$/.test(segment)
-        || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(segment))) {
+    if (segments.length === 0 || segments.some(segment => segment === '..')) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', `Unsafe archive entry path: ${entryPath}`);
     }
     return segments;
 }
+function sanitizeWindowsSegment(segment) {
+    if (segment === '.' || segment === '..') {
+        return segment;
+    }
+    const sanitized = [...segment].map(character => character.charCodeAt(0) < 0x20 || '<>:|?*"'.includes(character) ? '_' : character).join('')
+        .replace(/[. ]+$/g, trailing => '_'.repeat(trailing.length));
+    const reservedName = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])/i.exec(sanitized);
+    if (reservedName) {
+        let index = reservedName[0].length;
+        while (sanitized[index] === ' ') {
+            index++;
+        }
+        if (index === sanitized.length || sanitized[index] === '.') {
+            return `_${sanitized}`;
+        }
+    }
+    return sanitized;
+}
 function sanitizeOutputPath(entryPath) {
     if (process.platform !== 'win32') {
         return entryPath;
     }
-    return entryPath
-        .replace(/([. ]+)([\\/]|$)/g, (_match, unsupported, separator) => '_'.repeat(unsupported.length) + separator)
-        .replace(/[<>:|?*"]/g, '_');
+    return entryPath.replace(/\\/g, '/').split('/').map(sanitizeWindowsSegment).join('/');
+}
+function getExtractedPath(entryPath) {
+    const normalized = sanitizeOutputPath(entryPath).replace(/\\/g, '/');
+    const segments = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
+    return segments.join(node_path.sep);
 }
 function assertSafeRelativeArchivePath(entryPath) {
     const normalized = entryPath.replace(/\\/g, '/');
     const segments = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
-    if (entryPath.includes('\0')
-        || normalized.startsWith('/')
-        || /^[a-zA-Z]:/.test(normalized)
+    if (normalized.startsWith('/')
+        || /^[a-zA-Z]:\//.test(normalized)
         || segments.length === 0
         || segments.some(segment => segment === '..')) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', `Unsafe archive entry path: ${entryPath}`);
@@ -469,7 +486,12 @@ class Archive {
     }
     async entries() {
         this.assertOpen();
-        this.entriesPromise ??= native.entries(this.handle).catch((cause) => {
+        this.entriesPromise ??= native.entries(this.handle)
+            .then(entries => entries.map(entry => ({
+            ...entry,
+            extractedPath: getExtractedPath(entry.path),
+        })))
+            .catch((cause) => {
             throw new ArchiveError('ERR_ARCHIVE_OPEN', errorMessage(cause), { cause });
         });
         return this.entriesPromise;

package/dist/index.d.cts

@@ -5,6 +5,7 @@ type EntrySelector = EntryId | string;
 interface ArchiveEntry {
     readonly id: EntryId;
     readonly path: string;
+    readonly extractedPath: string;
     readonly size: bigint;
     readonly compressedSize: bigint;
     readonly isDirectory: boolean;

package/dist/index.d.mts

@@ -5,6 +5,7 @@ type EntrySelector = EntryId | string;
 interface ArchiveEntry {
     readonly id: EntryId;
     readonly path: string;
+    readonly extractedPath: string;
     readonly size: bigint;
     readonly compressedSize: bigint;
     readonly isDirectory: boolean;

package/dist/index.d.ts

@@ -5,6 +5,7 @@ type EntrySelector = EntryId | string;
 interface ArchiveEntry {
     readonly id: EntryId;
     readonly path: string;
+    readonly extractedPath: string;
     readonly size: bigint;
     readonly compressedSize: bigint;
     readonly isDirectory: boolean;

package/dist/index.mjs

@@ -3,7 +3,7 @@ import { rename, link, rm, lstat, mkdir } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { availableParallelism } from 'node:os';
-import { dirname, resolve, join, extname, relative, sep } from 'node:path';
+import { dirname, resolve, join, extname, sep, relative } from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 
@@ -63,32 +63,49 @@ function safeEntrySegments(entryPath) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', 'Archive entry path contains a null byte');
     }
     const normalized = entryPath.replace(/\\/g, '/');
-    if (normalized.startsWith('/') || /^[a-zA-Z]:/.test(normalized)) {
+    if (normalized.startsWith('/') || /^[a-zA-Z]:\//.test(normalized)) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', `Archive entry path is absolute: ${entryPath}`);
     }
     const segments = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
-    if (segments.length === 0 || segments.some(segment => segment === '..'
-        || segment.includes(':')
-        || /[. ]$/.test(segment)
-        || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(segment))) {
+    if (segments.length === 0 || segments.some(segment => segment === '..')) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', `Unsafe archive entry path: ${entryPath}`);
     }
     return segments;
 }
+function sanitizeWindowsSegment(segment) {
+    if (segment === '.' || segment === '..') {
+        return segment;
+    }
+    const sanitized = [...segment].map(character => character.charCodeAt(0) < 0x20 || '<>:|?*"'.includes(character) ? '_' : character).join('')
+        .replace(/[. ]+$/g, trailing => '_'.repeat(trailing.length));
+    const reservedName = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])/i.exec(sanitized);
+    if (reservedName) {
+        let index = reservedName[0].length;
+        while (sanitized[index] === ' ') {
+            index++;
+        }
+        if (index === sanitized.length || sanitized[index] === '.') {
+            return `_${sanitized}`;
+        }
+    }
+    return sanitized;
+}
 function sanitizeOutputPath(entryPath) {
     if (process.platform !== 'win32') {
         return entryPath;
     }
-    return entryPath
-        .replace(/([. ]+)([\\/]|$)/g, (_match, unsupported, separator) => '_'.repeat(unsupported.length) + separator)
-        .replace(/[<>:|?*"]/g, '_');
+    return entryPath.replace(/\\/g, '/').split('/').map(sanitizeWindowsSegment).join('/');
+}
+function getExtractedPath(entryPath) {
+    const normalized = sanitizeOutputPath(entryPath).replace(/\\/g, '/');
+    const segments = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
+    return segments.join(sep);
 }
 function assertSafeRelativeArchivePath(entryPath) {
     const normalized = entryPath.replace(/\\/g, '/');
     const segments = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
-    if (entryPath.includes('\0')
-        || normalized.startsWith('/')
-        || /^[a-zA-Z]:/.test(normalized)
+    if (normalized.startsWith('/')
+        || /^[a-zA-Z]:\//.test(normalized)
         || segments.length === 0
         || segments.some(segment => segment === '..')) {
         throw new ArchiveError('ERR_ARCHIVE_PATH', `Unsafe archive entry path: ${entryPath}`);
@@ -466,7 +483,12 @@ class Archive {
     }
     async entries() {
         this.assertOpen();
-        this.entriesPromise ??= native.entries(this.handle).catch((cause) => {
+        this.entriesPromise ??= native.entries(this.handle)
+            .then(entries => entries.map(entry => ({
+            ...entry,
+            extractedPath: getExtractedPath(entry.path),
+        })))
+            .catch((cause) => {
             throw new ArchiveError('ERR_ARCHIVE_OPEN', errorMessage(cause), { cause });
         });
         return this.entriesPromise;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "7zip-native",
-	"version": "0.0.10",
+	"version": "0.0.14",
 	"description": "Native 7zip bindings for Node.js",
 	"main": "./dist/index.cjs",
 	"type": "module",