@patrickdk77/archive-defuse 0.2.0 → 0.2.1

package/dist/tar.js

@@ -133,7 +133,7 @@ class TarArchive {
         const reader = new io_1.Reader(source, size);
         const notes = [];
         const entries = [];
-        let global = [];
+        let globalRecords = [];
         let pending = { pax: [] };
         let pos = 0;
         let total = 0;
@@ -203,7 +203,7 @@ class TarArchive {
                 if (typeflag === 'g') {
                     // Later global records replace earlier ones of the same key.
                     const keys = new Set(parsed.records.map(r => r.key));
-                    global = [...global.filter(r => !keys.has(r.key)), ...parsed.records];
+                    globalRecords = [...globalRecords.filter(r => !keys.has(r.key)), ...parsed.records];
                     const c = parsed.records.find(r => r.key === 'comment');
                     if (c)
                         comment = c.value.toString('utf8');
@@ -230,7 +230,7 @@ class TarArchive {
                 continue;
             }
             // The records that apply: global ones, then this entry's own, the later winning.
-            const records = [...global.filter(g => !pending.pax.some(r => r.key === g.key)), ...pending.pax];
+            const records = [...globalRecords.filter(g => !pending.pax.some(r => r.key === g.key)), ...pending.pax];
             const last = (key) => {
                 let found;
                 for (const r of records)
@@ -315,7 +315,7 @@ class TarArchive {
                 devmajor: posix || ustar === 'ustar ' ? num(329, 8, 'devmajor') : 0,
                 devminor: posix || ustar === 'ustar ' ? num(337, 8, 'devminor') : 0,
                 // Global records apply to every entry after them, so each entry keeps its own copy. A global comment is the archive's.
-                pax: records.filter(r => !isStructural(r.key) && !(r.key === 'comment' && global.includes(r))),
+                pax: records.filter(r => !isStructural(r.key) && !(r.key === 'comment' && globalRecords.includes(r))),
             };
             if (kind === 'symlink' || kind === 'hardlink')
                 e.linkTarget = linkTarget;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/archive-defuse",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Sanitize zip, tar, gzip, bzip2, zstd, Brotli, cab, 7z, xz and lzma archives. Detects path traversal, links out of the tree, device files, duplicate names, overlapping entries, hidden and prepended data, encrypted entries and compression bombs, hands every entry to file plugins, scores the risk, and writes a defused archive in the same format with no runtime dependencies.",
   "license": "MIT AND Apache-2.0",
   "author": "patrickdk77",