@pnpm/fetching.binary-fetcher 1101.0.0 → 1101.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/index.js +9 -1
- package/package.json +6 -6
package/lib/index.js
CHANGED
|
@@ -148,8 +148,16 @@ async function extractZipToTarget(zipPath, basename, targetDir, ignoreEntry) {
|
|
|
148
148
|
// advances `lastIndex` between calls, which would cause inconsistent skips across
|
|
149
149
|
// entries in this loop.
|
|
150
150
|
const testEntry = toStatelessTester(ignoreEntry);
|
|
151
|
-
// Extract each entry with path validation to prevent path traversal attacks
|
|
151
|
+
// Extract each entry with path validation to prevent path traversal attacks.
|
|
152
|
+
// Directory entries are skipped: AdmZip's `extractEntryTo(dir, ...)` expands
|
|
153
|
+
// to every descendant via `getEntryChildren`, which would bypass the
|
|
154
|
+
// `ignoreEntry` filter (e.g. the archive's top-level
|
|
155
|
+
// `node-vX.Y.Z-<platform>-<arch>/` entry would pull in npm/corepack files
|
|
156
|
+
// even though the per-file relative paths match the ignore regex).
|
|
157
|
+
// File extraction creates parent directories implicitly.
|
|
152
158
|
for (const entry of zip.getEntries()) {
|
|
159
|
+
if (entry.isDirectory)
|
|
160
|
+
continue;
|
|
153
161
|
const entryPath = entry.entryName;
|
|
154
162
|
validatePathSecurity(nodeDir, entryPath);
|
|
155
163
|
if (testEntry) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@pnpm/fetching.binary-fetcher",
|
|
3
|
-
"version": "1101.0.
|
|
3
|
+
"version": "1101.0.2",
|
|
4
4
|
"description": "A fetcher for binary archives",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"pnpm",
|
|
@@ -29,20 +29,20 @@
|
|
|
29
29
|
"rename-overwrite": "^7.0.1",
|
|
30
30
|
"ssri": "13.0.1",
|
|
31
31
|
"tempy": "3.0.0",
|
|
32
|
-
"@pnpm/
|
|
32
|
+
"@pnpm/error": "1100.0.0",
|
|
33
|
+
"@pnpm/fetching.fetcher-base": "1100.1.1",
|
|
33
34
|
"@pnpm/store.index": "1100.0.0",
|
|
34
|
-
"@pnpm/fetching.types": "1100.0.
|
|
35
|
-
"@pnpm/error": "1100.0.0"
|
|
35
|
+
"@pnpm/fetching.types": "1100.0.1"
|
|
36
36
|
},
|
|
37
37
|
"peerDependencies": {
|
|
38
|
-
"@pnpm/worker": "^1100.1.
|
|
38
|
+
"@pnpm/worker": "^1100.1.1"
|
|
39
39
|
},
|
|
40
40
|
"devDependencies": {
|
|
41
41
|
"@jest/globals": "30.3.0",
|
|
42
42
|
"@types/adm-zip": "^0.5.7",
|
|
43
43
|
"@types/ssri": "^7.1.5",
|
|
44
44
|
"tempy": "3.0.0",
|
|
45
|
-
"@pnpm/fetching.binary-fetcher": "1101.0.
|
|
45
|
+
"@pnpm/fetching.binary-fetcher": "1101.0.2"
|
|
46
46
|
},
|
|
47
47
|
"engines": {
|
|
48
48
|
"node": ">=22.13"
|