@pnpm/fetching.binary-fetcher 1100.0.2 → 1101.0.1

package/lib/index.d.ts

@@ -1,18 +1,31 @@
 import type { BinaryFetcher, FetchFunction } from '@pnpm/fetching.fetcher-base';
 import type { FetchFromRegistry } from '@pnpm/fetching.types';
 import type { StoreIndex } from '@pnpm/store.index';
-export declare function createBinaryFetcher(ctx: {
+export interface CreateBinaryFetcherOptions {
     fetch: FetchFromRegistry;
     fetchFromRemoteTarball: FetchFunction;
     storeIndex: StoreIndex;
     offline?: boolean;
-}): {
+    /**
+     * Per-package-name regex sources (compatible with `new RegExp(pattern)`) matching file
+     * paths inside the downloaded archive that should be skipped during extraction.
+     * The lookup key is `pkg.name`. For zip archives, paths are matched relative to the
+     * archive's top-level directory (i.e. after the `prefix` has been stripped).
+     */
+    archiveFilters?: Record<string, string>;
+}
+export declare function createBinaryFetcher(ctx: CreateBinaryFetcherOptions): {
     binary: BinaryFetcher;
 };
 export interface AssetInfo {
     url: string;
     integrity: string;
     basename: string;
+    /**
+     * Regex matched against each zip entry's path relative to the archive's top-level basename.
+     * Matching entries are skipped during extraction.
+     */
+    ignoreEntry?: RegExp;
 }
 /**
  * Downloads and unpacks a zip file containing a binary asset.

package/lib/index.js

@@ -1,5 +1,6 @@
 import fsPromises from 'node:fs/promises';
 import path from 'node:path';
+import util from 'node:util';
 import { PnpmError } from '@pnpm/error';
 import { addFilesFromDir } from '@pnpm/worker';
 import AdmZip from 'adm-zip';
@@ -8,6 +9,20 @@ import { renameOverwrite } from 'rename-overwrite';
 import ssri from 'ssri';
 import { temporaryDirectory } from 'tempy';
 export function createBinaryFetcher(ctx) {
+    // Snapshot and pre-compile `archiveFilters` at creation time so later mutations to the
+    // caller's object can't reintroduce invalid patterns, and so zip extraction doesn't
+    // recompile the regex per fetch. The tarball path still needs the pattern string — it
+    // crosses the worker thread boundary, where RegExp instances don't survive structured clone.
+    const archiveFilters = new Map();
+    for (const [name, pattern] of Object.entries(ctx.archiveFilters ?? {})) {
+        try {
+            archiveFilters.set(name, { pattern, regex: new RegExp(pattern) });
+        }
+        catch (err) {
+            const detail = util.types.isNativeError(err) ? `: ${err.message}` : '';
+            throw new PnpmError('INVALID_ARCHIVE_FILTER', `Invalid archive filter regex for "${name}"${detail}: ${pattern}`);
+        }
+    }
     const fetchBinary = async (cafs, resolution, opts) => {
         if (ctx.offline) {
             throw new PnpmError('CANNOT_DOWNLOAD_BINARY_OFFLINE', `Cannot download binary "${resolution.url}" because offline mode is enabled.`);
@@ -17,6 +32,7 @@ export function createBinaryFetcher(ctx) {
             version: opts.pkg.version,
             bin: resolution.bin,
         };
+        const archiveFilter = opts.pkg.name != null ? archiveFilters.get(opts.pkg.name) : undefined;
         let fetchResult;
         switch (resolution.archive) {
             case 'tarball': {
@@ -24,8 +40,9 @@ export function createBinaryFetcher(ctx) {
                     tarball: resolution.url,
                     integrity: resolution.integrity,
                 }, {
-                    appendManifest: manifest,
                     ...opts,
+                    appendManifest: manifest,
+                    ignoreFilePattern: archiveFilter?.pattern ?? opts.ignoreFilePattern,
                 });
                 break;
             }
@@ -35,6 +52,7 @@ export function createBinaryFetcher(ctx) {
                     url: resolution.url,
                     integrity: resolution.integrity,
                     basename: resolution.prefix ?? '',
+                    ignoreEntry: archiveFilter?.regex,
                 }, tempLocation);
                 fetchResult = await addFilesFromDir({
                     storeDir: cafs.storeDir,
@@ -72,7 +90,7 @@ export async function downloadAndUnpackZip(fetchFromRegistry, assetInfo, targetD
     const tmp = path.join(temporaryDirectory(), 'pnpm.zip');
     try {
         await downloadWithIntegrityCheck(fetchFromRegistry, assetInfo, tmp);
-        await extractZipToTarget(tmp, assetInfo.basename, targetDir);
+        await extractZipToTarget(tmp, assetInfo.basename, targetDir, assetInfo.ignoreEntry);
     }
     finally {
         // Clean up temporary file
@@ -114,24 +132,58 @@ async function downloadWithIntegrityCheck(fetchFromRegistry, { url, integrity },
  * @param zipPath - Path to the zip file
  * @param basename - Base name of the file (without extension)
  * @param targetDir - Directory where contents should be extracted
+ * @param ignoreEntry - Optional regex matched against the entry path relative to `basename`;
+ *   matching entries are skipped.
  * @throws {PnpmError} When extraction fails or path traversal is detected
  */
-async function extractZipToTarget(zipPath, basename, targetDir) {
+async function extractZipToTarget(zipPath, basename, targetDir, ignoreEntry) {
     const zip = new AdmZip(zipPath);
     const nodeDir = basename === '' ? targetDir : path.dirname(targetDir);
     // Validate basename/prefix doesn't escape the target directory
     if (basename !== '') {
         validatePathSecurity(nodeDir, basename);
     }
-    // Extract each entry with path validation to prevent path traversal attacks
+    const basenamePrefix = basename === '' ? '' : `${basename}/`;
+    // Normalize `ignoreEntry` to a stateless regex. `.test()` on a `/g` or `/y` regex
+    // advances `lastIndex` between calls, which would cause inconsistent skips across
+    // entries in this loop.
+    const testEntry = toStatelessTester(ignoreEntry);
+    // Extract each entry with path validation to prevent path traversal attacks.
+    // Directory entries are skipped: AdmZip's `extractEntryTo(dir, ...)` expands
+    // to every descendant via `getEntryChildren`, which would bypass the
+    // `ignoreEntry` filter (e.g. the archive's top-level
+    // `node-vX.Y.Z-<platform>-<arch>/` entry would pull in npm/corepack files
+    // even though the per-file relative paths match the ignore regex).
+    // File extraction creates parent directories implicitly.
     for (const entry of zip.getEntries()) {
+        if (entry.isDirectory)
+            continue;
         const entryPath = entry.entryName;
         validatePathSecurity(nodeDir, entryPath);
+        if (testEntry) {
+            const relative = basenamePrefix && entryPath.startsWith(basenamePrefix)
+                ? entryPath.slice(basenamePrefix.length)
+                : entryPath;
+            if (testEntry(relative))
+                continue;
+        }
         zip.extractEntryTo(entry, nodeDir, true, true);
     }
     const extractedDir = path.join(nodeDir, basename);
     await renameOverwrite(extractedDir, targetDir);
 }
+function toStatelessTester(regex) {
+    if (!regex)
+        return undefined;
+    // `/g` and `/y` make `RegExp.prototype.test` stateful via `lastIndex`.
+    // Strip those flags by cloning into a fresh RegExp with only the safe flags.
+    if (!regex.global && !regex.sticky) {
+        return (input) => regex.test(input);
+    }
+    const safeFlags = regex.flags.replace(/[gy]/g, '');
+    const clone = new RegExp(regex.source, safeFlags);
+    return (input) => clone.test(input);
+}
 /**
  * Validates that a path does not escape the base directory via path traversal.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/fetching.binary-fetcher",
-  "version": "1100.0.2",
+  "version": "1101.0.1",
   "description": "A fetcher for binary archives",
   "keywords": [
     "pnpm",
@@ -30,19 +30,19 @@
     "ssri": "13.0.1",
     "tempy": "3.0.0",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/fetching.fetcher-base": "1100.0.2",
-    "@pnpm/fetching.types": "1100.0.0",
-    "@pnpm/store.index": "1100.0.0"
+    "@pnpm/fetching.fetcher-base": "1100.1.0",
+    "@pnpm/store.index": "1100.0.0",
+    "@pnpm/fetching.types": "1100.0.0"
   },
   "peerDependencies": {
-    "@pnpm/worker": "^1100.0.2"
+    "@pnpm/worker": "^1100.1.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/adm-zip": "^0.5.7",
     "@types/ssri": "^7.1.5",
     "tempy": "3.0.0",
-    "@pnpm/fetching.binary-fetcher": "1100.0.2"
+    "@pnpm/fetching.binary-fetcher": "1101.0.1"
   },
   "engines": {
     "node": ">=22.13"