@pnpm/exe 11.9.0 → 11.10.0

package/dist/node_modules/tar/dist/commonjs/parse.js

@@ -60,6 +60,10 @@ const SAW_VALID_ENTRY = Symbol('sawValidEntry');
 const SAW_NULL_BLOCK = Symbol('sawNullBlock');
 const SAW_EOF = Symbol('sawEOF');
 const CLOSESTREAM = Symbol('closeStream');
+const MAX_DECOMPRESSION_RATIO = 1000;
+const COMPRESSEDBYTESREAD = Symbol('compressedBytesRead');
+const DECOMPRESSEDBYTESREAD = Symbol('decompressedBytesRead');
+const CHECKDECOMPRESSIONRATIO = Symbol('checkDecompressionRatio');
 const noop = () => true;
 class Parser extends events_1.EventEmitter {
     file;
@@ -68,6 +72,7 @@ class Parser extends events_1.EventEmitter {
     filter;
     brotli;
     zstd;
+    maxDecompressionRatio;
     writable = true;
     readable = false;
     [QUEUE] = [];
@@ -87,6 +92,8 @@ class Parser extends events_1.EventEmitter {
     [WRITING] = false;
     [CONSUMING] = false;
     [EMITTEDEND] = false;
+    [COMPRESSEDBYTESREAD] = 0;
+    [DECOMPRESSEDBYTESREAD] = 0;
     constructor(opt = {}) {
         super();
         this.file = opt.file || '';
@@ -109,6 +116,10 @@ class Parser extends events_1.EventEmitter {
             });
         }
         this.strict = !!opt.strict;
+        this.maxDecompressionRatio =
+            typeof opt.maxDecompressionRatio === 'number' ?
+                opt.maxDecompressionRatio
+                : MAX_DECOMPRESSION_RATIO;
         this.maxMetaEntrySize = opt.maxMetaEntrySize || maxMetaEntrySize;
         this.filter = typeof opt.filter === 'function' ? opt.filter : noop;
         // Unlike gzip, brotli doesn't have any magic bytes to identify it
@@ -362,11 +373,23 @@ class Parser extends events_1.EventEmitter {
         }
     }
     abort(error) {
+        if (this[ABORTED]) {
+            return;
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
         this.warn('TAR_ABORT', error, { recoverable: false });
     }
+    [CHECKDECOMPRESSIONRATIO](chunk) {
+        this[DECOMPRESSEDBYTESREAD] += chunk.length;
+        const ratio = this[DECOMPRESSEDBYTESREAD] / this[COMPRESSEDBYTESREAD];
+        if (ratio > this.maxDecompressionRatio) {
+            this.abort(new Error(`max decompression ratio exceeded: ${ratio.toFixed(2)} > ${this.maxDecompressionRatio}`));
+            return false;
+        }
+        return true;
+    }
     write(chunk, encoding, cb) {
         if (typeof encoding === 'function') {
             cb = encoding;
@@ -450,13 +473,22 @@ class Parser extends events_1.EventEmitter {
                     this[UNZIP] === undefined ? new minizlib_1.Unzip({})
                         : isZstd ? new minizlib_1.ZstdDecompress({})
                             : new minizlib_1.BrotliDecompress({});
-                this[UNZIP].on('data', chunk => this[CONSUMECHUNK](chunk));
-                this[UNZIP].on('error', er => this.abort(er));
+                this[UNZIP].on('data', chunk => {
+                    if (this[CHECKDECOMPRESSIONRATIO](chunk)) {
+                        this[CONSUMECHUNK](chunk);
+                    }
+                });
+                this[UNZIP].on('error', er => {
+                    if (!this[ABORTED]) {
+                        this.abort(er);
+                    }
+                });
                 this[UNZIP].on('end', () => {
                     this[ENDED] = true;
                     this[CONSUMECHUNK]();
                 });
                 this[WRITING] = true;
+                this[COMPRESSEDBYTESREAD] += chunk.length;
                 const ret = !!this[UNZIP][ended ? 'end' : 'write'](chunk);
                 this[WRITING] = false;
                 cb?.();
@@ -465,6 +497,7 @@ class Parser extends events_1.EventEmitter {
         }
         this[WRITING] = true;
         if (this[UNZIP]) {
+            this[COMPRESSEDBYTESREAD] += chunk.length;
             this[UNZIP].write(chunk);
         }
         else {
@@ -495,7 +528,7 @@ class Parser extends events_1.EventEmitter {
             !this[CONSUMING]) {
             this[EMITTEDEND] = true;
             const entry = this[WRITEENTRY];
-            if (entry && entry.blockRemain) {
+            if (entry?.blockRemain) {
                 // truncated, likely a damaged file
                 const have = this[BUFFER] ? this[BUFFER].length : 0;
                 this.warn('TAR_BAD_ARCHIVE', `Truncated input (needed ${entry.blockRemain} more bytes, only ${have} available)`, { entry });
@@ -589,8 +622,10 @@ class Parser extends events_1.EventEmitter {
         if (!this[ABORTED]) {
             if (this[UNZIP]) {
                 /* c8 ignore start */
-                if (chunk)
+                if (chunk) {
+                    this[COMPRESSEDBYTESREAD] += chunk.length;
                     this[UNZIP].write(chunk);
+                }
                 /* c8 ignore stop */
                 this[UNZIP].end();
             }

package/dist/node_modules/tar/dist/commonjs/pax.js

@@ -147,12 +147,36 @@ const parseKVLine = (set, line) => {
         return set;
     }
     const k = r.replace(/^SCHILY\.(dev|ino|nlink)/, '$1');
-    const v = kv.join('=');
-    set[k] =
-        /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(k) ?
-            new Date(Number(v) * 1000)
-            : /^[0-9]+$/.test(v) ? +v
-                : v;
+    const v = kv.join('=').replace(/\0.*/, '');
+    switch (k) {
+        case 'path':
+        case 'linkpath':
+        case 'type':
+        case 'charset':
+        case 'comment':
+        case 'gname':
+        case 'uname':
+            set[k] = v;
+            break;
+        case 'ctime':
+        case 'atime':
+        case 'mtime':
+            set[k] = new Date(Number(v) * 1000);
+            break;
+        case 'size':
+            const s = +v;
+            if (s >= 0)
+                set[k] = s;
+            break;
+        case 'gid':
+        case 'uid':
+        case 'dev':
+        case 'ino':
+        case 'nlink':
+        case 'mode':
+            set[k] = +v;
+            break;
+    }
     return set;
 };
 //# sourceMappingURL=pax.js.map

package/dist/node_modules/tar/dist/commonjs/unpack.js

@@ -185,7 +185,7 @@ class Unpack extends parse_js_1.Parser {
         // default true for root
         this.preserveOwner =
             opt.preserveOwner === undefined && typeof opt.uid !== 'number' ?
-                !!(process.getuid && process.getuid() === 0)
+                !!(process.getuid?.() === 0)
                 : !!opt.preserveOwner;
         this.processUid =
             (this.preserveOwner || this.setOwner) && process.getuid ?
@@ -406,7 +406,7 @@ class Unpack extends parse_js_1.Parser {
         }
     }
     [MKDIR](dir, mode, cb) {
-        (0, mkdir_js_1.mkdir)((0, normalize_windows_path_js_1.normalizeWindowsPath)(dir), {
+        void (0, mkdir_js_1.mkdir)((0, normalize_windows_path_js_1.normalizeWindowsPath)(dir), {
             uid: this.uid,
             gid: this.gid,
             processUid: this.processUid,

package/dist/node_modules/tar/dist/esm/header.js

@@ -5,6 +5,7 @@
 import { posix as pathModule } from 'node:path';
 import * as large from './large-numbers.js';
 import * as types from './types.js';
+const notNegative = (n) => n === undefined || n < 0 ? undefined : n;
 export class Header {
     cksumValid = false;
     needPax = false;
@@ -63,10 +64,9 @@ export class Header {
             exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
         this.gid =
             exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
-        this.size =
-            exForFields?.size ??
-                gexForFields?.size ??
-                decNumber(buf, off + 124, 12);
+        this.size = notNegative(exForFields?.size ??
+            gexForFields?.size ??
+            decNumber(buf, off + 124, 12));
         this.mtime =
             exForFields?.mtime ??
                 gexForFields?.mtime ??
@@ -152,6 +152,7 @@ export class Header {
             // null/undefined values are ignored.
             return !(v === null ||
                 v === undefined ||
+                (k === 'size' && Number(v) < 0) ||
                 (k === 'path' && gex) ||
                 (k === 'linkpath' && gex) ||
                 k === 'global');