@sasjs/cli 4.20.1 → 4.20.3

package/build/utils/zip.js

@@ -0,0 +1,277 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractZip = void 0;
+var fs_1 = __importDefault(require("fs"));
+var path_1 = __importDefault(require("path"));
+var yauzl_1 = require("yauzl");
+/**
+ * Extracts a zip archive to the given directory.
+ *
+ * Replaces adm-zip's extractAllTo (GHSA-vwc7-r8mq-g2x9: extraction follows
+ * destination symlinks, allowing arbitrary file overwrite). This
+ * implementation never follows symlinks at the destination: every path
+ * component is checked with fs.lstatSync and extraction of an entry aborts
+ * if a symlink is found where a directory or file is expected.
+ *
+ * Directories mentioned only implicitly by entry paths are created; explicit
+ * directory entries are honoured. Unix file mode bits are preserved (needed
+ * by e.g. .git-hooks files in seed apps, which git requires to be
+ * executable). Overwriting of existing regular files is opt-in; existing
+ * symlinks are never written through.
+ *
+ * @param {string} zipPath - path of the zip archive to extract.
+ * @param {string} destDir - directory to extract into (created if missing).
+ * @param {boolean} overwrite - whether existing regular files are replaced.
+ */
+var extractZip = function (zipPath_1, destDir_1) {
+    var args_1 = [];
+    for (var _i = 2; _i < arguments.length; _i++) {
+        args_1[_i - 2] = arguments[_i];
+    }
+    return __awaiter(void 0, __spreadArray([zipPath_1, destDir_1], __read(args_1), false), void 0, function (zipPath, destDir, overwrite) {
+        var zipfile, _a, _b, _c, entry, e_1_1;
+        var _d, e_1, _e, _f;
+        if (overwrite === void 0) { overwrite = false; }
+        return __generator(this, function (_g) {
+            switch (_g.label) {
+                case 0: return [4 /*yield*/, (0, yauzl_1.openPromise)(zipPath, {
+                        lazyEntries: true,
+                        decodeStrings: true,
+                        validateEntrySizes: true
+                    })];
+                case 1:
+                    zipfile = _g.sent();
+                    _g.label = 2;
+                case 2:
+                    _g.trys.push([2, , 16, 17]);
+                    _g.label = 3;
+                case 3:
+                    _g.trys.push([3, 9, 10, 15]);
+                    _a = true, _b = __asyncValues(zipfile.eachEntry());
+                    _g.label = 4;
+                case 4: return [4 /*yield*/, _b.next()];
+                case 5:
+                    if (!(_c = _g.sent(), _d = _c.done, !_d)) return [3 /*break*/, 8];
+                    _f = _c.value;
+                    _a = false;
+                    entry = _f;
+                    return [4 /*yield*/, extractEntry(zipfile, entry, destDir, overwrite)];
+                case 6:
+                    _g.sent();
+                    _g.label = 7;
+                case 7:
+                    _a = true;
+                    return [3 /*break*/, 4];
+                case 8: return [3 /*break*/, 15];
+                case 9:
+                    e_1_1 = _g.sent();
+                    e_1 = { error: e_1_1 };
+                    return [3 /*break*/, 15];
+                case 10:
+                    _g.trys.push([10, , 13, 14]);
+                    if (!(!_a && !_d && (_e = _b.return))) return [3 /*break*/, 12];
+                    return [4 /*yield*/, _e.call(_b)];
+                case 11:
+                    _g.sent();
+                    _g.label = 12;
+                case 12: return [3 /*break*/, 14];
+                case 13:
+                    if (e_1) throw e_1.error;
+                    return [7 /*endfinally*/];
+                case 14: return [7 /*endfinally*/];
+                case 15: return [3 /*break*/, 17];
+                case 16:
+                    zipfile.close();
+                    return [7 /*endfinally*/];
+                case 17: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.extractZip = extractZip;
+var extractEntry = function (zipfile, entry, destDir, overwrite) { return __awaiter(void 0, void 0, void 0, function () {
+    var entryPath, isDirectoryEntry, destPath, parents, destStat, readStream, mode;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                entryPath = entry.fileName;
+                isDirectoryEntry = entryPath.endsWith('/');
+                destPath = path_1.default.join(destDir, entryPath);
+                parents = path_1.default.dirname(destPath);
+                return [4 /*yield*/, ensureDirNoSymlink(destDir, parents)];
+            case 1:
+                _a.sent();
+                if (isDirectoryEntry) {
+                    // Explicit directory entry: create it (mode as-is; dirs are rwxr-xr-x by default).
+                    fs_1.default.mkdirSync(destPath, { recursive: true });
+                    return [2 /*return*/];
+                }
+                destStat = null;
+                try {
+                    destStat = fs_1.default.lstatSync(destPath);
+                }
+                catch (_b) {
+                    destStat = null;
+                }
+                if (destStat) {
+                    if (destStat.isSymbolicLink()) {
+                        throw new Error("Refusing to extract \"".concat(entryPath, "\": destination is a symbolic link."));
+                    }
+                    if (!destStat.isFile()) {
+                        throw new Error("Refusing to extract \"".concat(entryPath, "\": destination is not a regular file."));
+                    }
+                    if (!overwrite)
+                        return [2 /*return*/];
+                }
+                return [4 /*yield*/, zipfile.openReadStreamPromise(entry)];
+            case 2:
+                readStream = _a.sent();
+                return [4 /*yield*/, streamToFile(readStream, destPath)
+                    // Preserve unix mode bits (external attrs high 16 bits), e.g. the exec bit
+                    // on .git-hooks files in seed apps. Only entries created on a unix host
+                    // (versionMadeBy platform 3) are honoured: archives created on other
+                    // hosts (Windows, DOS, ...) leave these bits zero or repurpose them, and
+                    // chmod-ing a mode derived from them would give the file garbage
+                    // permissions.
+                ];
+            case 3:
+                _a.sent();
+                mode = entry.versionMadeBy >>> 8 === 3
+                    ? (entry.externalFileAttributes >>> 16) & 4095
+                    : 0;
+                if (mode)
+                    fs_1.default.chmodSync(destPath, mode);
+                return [2 /*return*/];
+        }
+    });
+}); };
+/**
+ * Creates dirPath (which must be at or under rootDir), creating parents as
+ * needed, and throws if any existing path component is a symbolic link.
+ *
+ * NOTE: the existsSync/lstatSync/mkdirSync sequence is inherently racy
+ * (TOCTOU) - a symlink swapped in between the check and the mkdir is
+ * traversed. Extraction is therefore strictly sequential, one entry at a
+ * time. Do not extract entries in parallel into a shared destDir without
+ * closing this window first.
+ */
+var ensureDirNoSymlink = function (rootDir, dirPath) { return __awaiter(void 0, void 0, void 0, function () {
+    var rootParts, targetParts, current, i, exists, stat;
+    return __generator(this, function (_a) {
+        rootParts = path_1.default.resolve(rootDir).split(path_1.default.sep);
+        targetParts = path_1.default.resolve(dirPath).split(path_1.default.sep);
+        current = rootParts[0] || path_1.default.sep;
+        for (i = 1; i < targetParts.length; i++) {
+            current = path_1.default.join(current, targetParts[i]);
+            exists = fs_1.default.existsSync(current);
+            if (exists) {
+                stat = fs_1.default.lstatSync(current);
+                if (stat.isSymbolicLink()) {
+                    throw new Error("Refusing to extract into \"".concat(current, "\": symbolic link in destination path."));
+                }
+                if (!stat.isDirectory()) {
+                    throw new Error("Cannot extract into \"".concat(current, "\": exists and is not a directory."));
+                }
+            }
+            else {
+                fs_1.default.mkdirSync(current, { recursive: false });
+            }
+        }
+        return [2 /*return*/];
+    });
+}); };
+var streamToFile = function (readStream, destPath) { return __awaiter(void 0, void 0, void 0, function () {
+    var writeStream;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                writeStream = fs_1.default.createWriteStream(destPath, {
+                    flags: 'w',
+                    mode: 438
+                });
+                return [4 /*yield*/, pipelinePromise(readStream, writeStream)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+var pipelinePromise = function (readable, writable) {
+    return new Promise(function (resolve, reject) {
+        readable.on('error', reject);
+        writable.on('error', reject);
+        writable.on('close', resolve);
+        readable.pipe(writable);
+    });
+};

package/package.json

@@ -70,59 +70,62 @@
   },
   "dependencies": {
     "@sasjs/adapter": "^4.19.0",
-    "@sasjs/core": "4.68.1",
-    "@sasjs/lint": "2.4.3",
-    "@sasjs/utils": "^3.6.0",
-    "adm-zip": "0.6.0",
+    "@sasjs/core": "5.2.4",
+    "@sasjs/lint": "2.5.0",
+    "@sasjs/utils": "3.6.2",
     "chalk": "4.1.2",
-    "dotenv": "16.0.3",
+    "dotenv": "17.4.2",
     "find": "0.3.0",
-    "js-base64": "3.7.5",
-    "jsdom": "23.2.0",
+    "js-base64": "3.9.3",
+    "jsdom": "26.0.0",
     "jwt-decode": "3.1.2",
     "lodash.groupby": "4.6.0",
     "lodash.uniqby": "4.7.0",
     "node-graphviz": "0.1.1",
     "node-powershell": "5.0.1",
     "ora": "5.4.1",
-    "prompts": "2.4.1",
+    "prompts": "2.4.2",
     "shelljs": "0.10.0",
     "ssl-root-cas": "1.3.1",
     "xml": "1.0.1",
-    "yargs": "17.6.2"
+    "yargs": "17.6.2",
+    "yauzl": "3.4.0",
+    "yazl": "3.3.1"
   },
   "devDependencies": {
     "@babel/core": "7.29.7",
-    "@babel/preset-env": "7.22.0",
-    "@babel/preset-typescript": "7.22.5",
-    "@types/adm-zip": "0.5.0",
-    "@types/debug": "4.1.7",
-    "@types/find": "0.2.1",
-    "@types/jest": "29.4.0",
+    "@babel/preset-env": "7.29.7",
+    "@babel/preset-typescript": "7.29.7",
+    "@nogoo9/gitleaks": "8.30.1-post.2",
+    "@types/debug": "4.1.13",
+    "@types/find": "0.2.4",
+    "@types/jest": "30.0.0",
     "@types/jsdom": "21.1.1",
-    "@types/lodash.groupby": "4.6.6",
-    "@types/lodash.uniqby": "4.7.6",
-    "@types/node": "18.14.1",
-    "@types/shelljs": "0.8.9",
-    "@types/url-parse": "1.4.4",
-    "@types/xml": "1.0.6",
-    "babel-jest": "29.7.0",
+    "@types/lodash.groupby": "4.6.9",
+    "@types/lodash.uniqby": "4.7.9",
+    "@types/node": "22.10.2",
+    "@types/shelljs": "0.8.10",
+    "@types/url-parse": "1.4.11",
+    "@types/xml": "1.0.11",
+    "@types/yauzl": "3.4.0",
+    "@types/yazl": "3.3.1",
+    "babel-jest": "30.5.1",
     "copyfiles": "2.4.1",
-    "jest": "29.4.3",
-    "jest-cli": "29.4.3",
-    "jest-environment-jsdom": "29.4.3",
-    "jest-extended": "3.2.4",
-    "nodemon": "3.0.1",
-    "prettier": "2.6.2",
-    "ts-jest": "29.0.5",
-    "ts-node": "10.4.0",
-    "tslib": "2.3.1",
-    "typescript": "4.9.5",
-    "util": "0.12.4"
+    "jest": "30.5.1",
+    "jest-cli": "30.5.1",
+    "jest-environment-jsdom": "30.5.1",
+    "jest-extended": "4.0.2",
+    "nodemon": "3.1.14",
+    "prettier": "3.9.6",
+    "ts-jest": "29.4.12",
+    "ts-node": "10.9.2",
+    "tslib": "2.8.1",
+    "typescript": "5.9.3",
+    "util": "0.12.5"
   },
   "overrides": {
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "4.20.1"
+  "version": "4.20.3"
 }