@sasjs/cli 4.20.2 → 4.20.3

package/README.md

@@ -53,6 +53,17 @@ Running `npm i -g @sasjs/cli@latest` does not always upgrade properly. This is d
 
 If you are running NPM in version 6 or below, you can try running `npm update -g @sasjs/cli` instead, or - the sledgehammer approach - delete the files from the NPM folder and then do a fresh install.
 
+## Contributing
+
+1.  Clone the repo and install dependencies (`npm install`).
+2.  One-time setup: point git at this repo's hooks directory:
+
+```
+  git config core.hooksPath ./.git-hooks
+```
+
+This enables the pre-commit checks (gitleaks secret scan, 2MB commit size limit). This step is required because the repo's `.npmrc` sets `ignore-scripts=true`, so the `prepare` script that would configure the hooks path automatically never runs on install. If you skip it, your commits are not scanned for secrets and you may push them that way.
+
 ## Star Gazing
 
 If you find this library useful, please leave a star and help us grow our star graph!

package/build/utils/compressAndSave.js

@@ -41,7 +41,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.compressAndSave = void 0;
 var path_1 = __importDefault(require("path"));
-var adm_zip_1 = __importDefault(require("adm-zip"));
+var fs_1 = __importDefault(require("fs"));
+var yazl_1 = __importDefault(require("yazl"));
 /**
  * Creates a zip file.
  * Having single JSON file in it.
@@ -53,11 +54,15 @@ var compressAndSave = function (saveTo, contents) { return __awaiter(void 0, voi
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
-                zip = new adm_zip_1.default();
+                zip = new yazl_1.default.ZipFile();
                 filenameInZip = path_1.default.basename(saveTo, path_1.default.extname(saveTo));
                 // add file directly
-                zip.addFile(filenameInZip, Buffer.from(contents, 'utf8'), 'entry comment goes here');
-                return [4 /*yield*/, zip.writeZipPromise(saveTo, { overwrite: true })];
+                zip.addBuffer(Buffer.from(contents, 'utf8'), filenameInZip);
+                return [4 /*yield*/, new Promise(function (resolve, reject) {
+                        zip.outputStream.on('error', reject);
+                        zip.outputStream.pipe(fs_1.default.createWriteStream(saveTo)).on('close', resolve);
+                        zip.end();
+                    })];
             case 1:
                 _a.sent();
                 return [2 /*return*/];

package/build/utils/spec/zip.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/spec/zip.spec.js

@@ -0,0 +1,282 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var fs_1 = __importDefault(require("fs"));
+var path_1 = __importDefault(require("path"));
+var yazl_1 = __importDefault(require("yazl"));
+var utils_1 = require("@sasjs/utils");
+var zip_1 = require("../zip");
+var utils_2 = require("@sasjs/utils");
+var makeZip = function (entries, zipPath) {
+    return new Promise(function (resolve, reject) {
+        var zip = new yazl_1.default.ZipFile();
+        entries.forEach(function (e) {
+            return zip.addBuffer(Buffer.from(e.content, 'utf8'), e.name, { mode: e.mode });
+        });
+        zip.outputStream.pipe(fs_1.default.createWriteStream(zipPath)).on('close', resolve);
+        zip.outputStream.on('error', reject);
+        zip.end();
+    });
+};
+/**
+ * Rewrites the versionMadeBy host platform byte (high byte of the central
+ * directory field) of every entry, simulating an archive created on a
+ * different host (e.g. 0 = MS-DOS/Windows). Used to prove that mode bits
+ * from non-unix hosts are ignored.
+ */
+var setEntryPlatform = function (zipPath, platform) {
+    var buffer = fs_1.default.readFileSync(zipPath);
+    var eocd = buffer.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]));
+    if (eocd < 0)
+        throw new Error('end of central directory record not found');
+    var cdSize = buffer.readUInt32LE(eocd + 12);
+    var cdOffset = buffer.readUInt32LE(eocd + 16);
+    var p = cdOffset;
+    var end = cdOffset + cdSize;
+    while (p < end) {
+        if (buffer.readUInt32LE(p) !== 0x02014b50)
+            break; // central file header
+        var versionMadeBy = buffer.readUInt16LE(p + 4);
+        buffer.writeUInt16LE((versionMadeBy & 0xff) | (platform << 8), p + 4);
+        var nlen = buffer.readUInt16LE(p + 28);
+        var elen = buffer.readUInt16LE(p + 30);
+        var clen = buffer.readUInt16LE(p + 32);
+        p += 46 + nlen + elen + clen;
+    }
+    fs_1.default.writeFileSync(zipPath, buffer);
+};
+describe('zip', function () {
+    var tmpRoot = path_1.default.join(__dirname, "zip-spec-".concat((0, utils_2.generateTimestamp)()));
+    var destDir = path_1.default.join(tmpRoot, 'dest');
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            fs_1.default.mkdirSync(destDir, { recursive: true });
+            return [2 /*return*/];
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, utils_2.deleteFolder)(tmpRoot).catch(function () { })];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    describe('extractZip', function () {
+        it('should extract nested files and create implicit directories', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath, nested, top;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        zipPath = path_1.default.join(tmpRoot, 'app.zip');
+                        return [4 /*yield*/, makeZip([
+                                { name: 'app-main/a/b/file.txt', content: 'nested content' },
+                                { name: 'app-main/top.txt', content: 'top content' }
+                            ], zipPath)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, (0, zip_1.extractZip)(zipPath, destDir, true)];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, (0, utils_2.readFile)(path_1.default.join(destDir, 'app-main', 'a', 'b', 'file.txt'))];
+                    case 3:
+                        nested = _a.sent();
+                        expect(nested).toEqual('nested content');
+                        return [4 /*yield*/, (0, utils_2.readFile)(path_1.default.join(destDir, 'app-main', 'top.txt'))];
+                    case 4:
+                        top = _a.sent();
+                        expect(top).toEqual('top content');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should create explicit directory entries', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        zipPath = path_1.default.join(tmpRoot, 'dirs.zip');
+                        return [4 /*yield*/, makeZip([{ name: 'app-main/public/docs/.gitkeep', content: '' }], zipPath)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, (0, zip_1.extractZip)(zipPath, destDir, true)];
+                    case 2:
+                        _a.sent();
+                        expect(fs_1.default.existsSync(path_1.default.join(destDir, 'app-main', 'public', 'docs'))).toBeTrue();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should preserve unix mode bits', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath, hookMode;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if ((0, utils_1.isWindows)())
+                            return [2 /*return*/]; // chmod exec bits are a no-op on Windows
+                        zipPath = path_1.default.join(tmpRoot, 'modes.zip');
+                        return [4 /*yield*/, makeZip([
+                                { name: 'app-main/hook', content: '#!/bin/bash\n', mode: 493 },
+                                { name: 'app-main/plain.txt', content: 'plain', mode: 420 }
+                            ], zipPath)];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, (0, zip_1.extractZip)(zipPath, destDir, true)];
+                    case 2:
+                        _a.sent();
+                        hookMode = fs_1.default.statSync(path_1.default.join(destDir, 'app-main', 'hook')).mode;
+                        expect(hookMode & 73).not.toEqual(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should not apply mode bits from non-unix (e.g. Windows) archives', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath, mode;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if ((0, utils_1.isWindows)())
+                            return [2 /*return*/]; // chmod exec bits are a no-op on Windows
+                        zipPath = path_1.default.join(tmpRoot, 'winmodes.zip');
+                        return [4 /*yield*/, makeZip([{ name: 'app-main/binary', content: 'MZ', mode: 493 }], zipPath)
+                            // Simulate a Windows-created archive: same externalFileAttributes
+                            // (exec bits set by yazl), but versionMadeBy platform 0 (MS-DOS).
+                        ];
+                    case 1:
+                        _a.sent();
+                        // Simulate a Windows-created archive: same externalFileAttributes
+                        // (exec bits set by yazl), but versionMadeBy platform 0 (MS-DOS).
+                        setEntryPlatform(zipPath, 0);
+                        return [4 /*yield*/, (0, zip_1.extractZip)(zipPath, destDir, true)
+                            // The entry's externalFileAttributes high bits are not a unix mode
+                            // on non-unix platforms - applying them would chmod the file 755.
+                        ];
+                    case 2:
+                        _a.sent();
+                        mode = fs_1.default.statSync(path_1.default.join(destDir, 'app-main', 'binary')).mode;
+                        expect(mode & 73).toEqual(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should not write through a symlink at the destination', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath, victimPath, victim;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if ((0, utils_1.isWindows)())
+                            return [2 /*return*/]; // symlink creation needs elevated privileges
+                        zipPath = path_1.default.join(tmpRoot, 'evil.zip');
+                        return [4 /*yield*/, makeZip([{ name: 'app-main/target.txt', content: 'EVIL' }], zipPath)];
+                    case 1:
+                        _a.sent();
+                        victimPath = path_1.default.join(tmpRoot, 'victim.txt');
+                        return [4 /*yield*/, (0, utils_2.createFile)(victimPath, 'ORIGINAL')
+                            // plant a symlink where the entry wants to write
+                        ];
+                    case 2:
+                        _a.sent();
+                        // plant a symlink where the entry wants to write
+                        fs_1.default.mkdirSync(path_1.default.join(destDir, 'app-main'), { recursive: true });
+                        fs_1.default.symlinkSync(victimPath, path_1.default.join(destDir, 'app-main', 'target.txt'));
+                        return [4 /*yield*/, expect((0, zip_1.extractZip)(zipPath, destDir, true)).rejects.toThrow(/symbolic link/)];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, (0, utils_2.readFile)(victimPath)];
+                    case 4:
+                        victim = _a.sent();
+                        expect(victim).toEqual('ORIGINAL');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should not extract into a symlinked parent directory', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath, realDir, linkDir;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if ((0, utils_1.isWindows)())
+                            return [2 /*return*/]; // symlink creation needs elevated privileges
+                        zipPath = path_1.default.join(tmpRoot, 'evilparent.zip');
+                        return [4 /*yield*/, makeZip([{ name: 'app-main/x.txt', content: 'x' }], zipPath)];
+                    case 1:
+                        _a.sent();
+                        realDir = path_1.default.join(tmpRoot, 'realdir');
+                        fs_1.default.mkdirSync(realDir, { recursive: true });
+                        linkDir = path_1.default.join(tmpRoot, 'linkdir');
+                        fs_1.default.symlinkSync(realDir, linkDir);
+                        return [4 /*yield*/, expect((0, zip_1.extractZip)(zipPath, linkDir, true)).rejects.toThrow(/symbolic link/)];
+                    case 2:
+                        _a.sent();
+                        expect(fs_1.default.readdirSync(realDir).length).toEqual(0);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should skip existing files when overwrite is false', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var zipPath, existingPath, content;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        zipPath = path_1.default.join(tmpRoot, 'skip.zip');
+                        return [4 /*yield*/, makeZip([{ name: 'app-main/skipme.txt', content: 'NEW' }], zipPath)];
+                    case 1:
+                        _a.sent();
+                        existingPath = path_1.default.join(destDir, 'app-main', 'skipme.txt');
+                        fs_1.default.mkdirSync(path_1.default.join(destDir, 'app-main'), { recursive: true });
+                        return [4 /*yield*/, (0, utils_2.createFile)(existingPath, 'EXISTING')];
+                    case 2:
+                        _a.sent();
+                        return [4 /*yield*/, (0, zip_1.extractZip)(zipPath, destDir, false)];
+                    case 3:
+                        _a.sent();
+                        return [4 /*yield*/, (0, utils_2.readFile)(existingPath)];
+                    case 4:
+                        content = _a.sent();
+                        expect(content).toEqual('EXISTING');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});

package/build/utils/utils.js

@@ -117,7 +117,7 @@ var axios_1 = __importDefault(require("axios"));
 var utils_1 = require("@sasjs/utils");
 var displayResult_1 = require("./displayResult");
 var dotenv_1 = __importDefault(require("dotenv"));
-var adm_zip_1 = __importDefault(require("adm-zip"));
+var zip_1 = require("./zip");
 var config_1 = require("./config");
 function inExistingProject(folderPath) {
     return __awaiter(this, void 0, void 0, function () {
@@ -151,10 +151,14 @@ function createReactApp(folderPath) {
         return __generator(this, function (_a) {
             return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
                     return __generator(this, function (_a) {
-                        createApp(folderPath, 'https://github.com/sasjs/react-seed-app', 'https://github.com/sasjs/docs', function (err) {
-                            return reject(new Error(err));
-                        });
-                        return [2 /*return*/, resolve()];
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, createApp(folderPath, 'https://github.com/sasjs/react-seed-app', 'https://github.com/sasjs/docs', function (err) {
+                                    return reject(new Error(err));
+                                })];
+                            case 1:
+                                _a.sent();
+                                return [2 /*return*/, resolve()];
+                        }
                     });
                 }); })];
         });
@@ -166,10 +170,14 @@ function createAngularApp(folderPath) {
         return __generator(this, function (_a) {
             return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
                     return __generator(this, function (_a) {
-                        createApp(folderPath, 'https://github.com/sasjs/angular-seed-app', 'https://github.com/sasjs/docs', function (err) {
-                            return reject(new Error(err));
-                        });
-                        return [2 /*return*/, resolve()];
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, createApp(folderPath, 'https://github.com/sasjs/angular-seed-app', 'https://github.com/sasjs/docs', function (err) {
+                                    return reject(new Error(err));
+                                })];
+                            case 1:
+                                _a.sent();
+                                return [2 /*return*/, resolve()];
+                        }
                     });
                 }); })];
         });
@@ -181,10 +189,14 @@ function createMinimalApp(folderPath) {
         return __generator(this, function (_a) {
             return [2 /*return*/, new Promise(function (resolve, reject) { return __awaiter(_this, void 0, void 0, function () {
                     return __generator(this, function (_a) {
-                        createApp(folderPath, 'https://github.com/sasjs/minimal-seed-app', 'https://github.com/sasjs/docs', function (err) {
-                            return reject(new Error(err));
-                        });
-                        return [2 /*return*/, resolve()];
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, createApp(folderPath, 'https://github.com/sasjs/minimal-seed-app', 'https://github.com/sasjs/docs', function (err) {
+                                    return reject(new Error(err));
+                                })];
+                            case 1:
+                                _a.sent();
+                                return [2 /*return*/, resolve()];
+                        }
                     });
                 }); })];
         });
@@ -207,9 +219,11 @@ function createTemplateApp(folderPath, template) {
                                 if (stderr.includes('404: Not Found') || code) {
                                     return [2 /*return*/, reject(new Error("Template \"".concat(template, "\" is not a SASjs template")))];
                                 }
-                                createApp(folderPath, "https://github.com/sasjs/template_".concat(template), 'https://github.com/sasjs/docs', function (err) {
-                                    return reject(new Error(err));
-                                });
+                                return [4 /*yield*/, createApp(folderPath, "https://github.com/sasjs/template_".concat(template), 'https://github.com/sasjs/docs', function (err) {
+                                        return reject(new Error(err));
+                                    })];
+                            case 2:
+                                _b.sent();
                                 return [2 /*return*/, resolve()];
                         }
                     });
@@ -225,44 +239,53 @@ function createTemplateApp(folderPath, template) {
  * @param docsUrl sasjs/docs repo url
  * @params installDependencies whether or not to do `npm install`
  */
-function createApp(folderPath, repoUrl, docsUrl, errorCallback, installDependencies) {
-    if (installDependencies === void 0) { installDependencies = true; }
-    //In past we used GIT to clone the repos. But many users potentially won't have GIT installed.
-    //So we will use shell tools to set up the apps.
-    var zipName = 'main.zip';
-    var zipPath = "/archive/refs/heads/";
-    var fullZipPath = "".concat(zipPath).concat(zipName);
-    var spinner = (0, ora_1.default)("Creating SASjs project in ".concat(folderPath, "."));
-    spinner.start();
-    //Get repo zip, assuming main branch is called `main`
-    var _a = downloadFile("".concat(repoUrl).concat(fullZipPath), zipName), stdout = _a.stdout, stderr = _a.stderr, code = _a.code;
-    // If doesn't exist, we try again, but with master.zip for the zip name.
-    // Since that's the name generated from branch name.
-    if (stderr.includes('404: Not Found') || code) {
-        zipName = 'master.zip';
-        var _b = downloadFile("".concat(repoUrl).concat(zipPath).concat(zipName), zipName), stdout_1 = _b.stdout, stderr_1 = _b.stderr, code_1 = _b.code;
-        if (stderr_1.includes('404: Not Found') || code_1) {
-            errorCallback("".concat(repoUrl).concat(zipPath, " is not SASjs repository!"));
-            return;
-        }
-    }
-    var zipWithoutExtension = zipName.replace('.zip', '');
-    var zip = new adm_zip_1.default(zipName);
-    zip.extractAllTo("./", true);
-    shelljs_1.default.cp('-r', "".concat(shelljs_1.default.ls('-d', "./*".concat(zipWithoutExtension))[0], "/."), folderPath);
-    shelljs_1.default.rm('-rf', ["./*".concat(zipWithoutExtension)]);
-    shelljs_1.default.rm('-rf', ["./".concat(zipName)]);
-    loadDocsSubmodule(docsUrl, folderPath, fullZipPath);
-    shelljs_1.default.rm('-f', [path_1.default.join(folderPath, '.gitmodules')]);
-    spinner.stop();
-    if (installDependencies) {
-        spinner.text = 'Installing dependencies...';
-        spinner.start();
-        shelljs_1.default.exec("cd \"".concat(folderPath, "\" && npm install"), {
-            silent: true
+function createApp(folderPath_1, repoUrl_1, docsUrl_1, errorCallback_1) {
+    return __awaiter(this, arguments, void 0, function (folderPath, repoUrl, docsUrl, errorCallback, installDependencies) {
+        var zipName, zipPath, fullZipPath, spinner, _a, stdout, stderr, code, _b, stdout_1, stderr_1, code_1, zipWithoutExtension;
+        if (installDependencies === void 0) { installDependencies = true; }
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    zipName = 'main.zip';
+                    zipPath = "/archive/refs/heads/";
+                    fullZipPath = "".concat(zipPath).concat(zipName);
+                    spinner = (0, ora_1.default)("Creating SASjs project in ".concat(folderPath, "."));
+                    spinner.start();
+                    _a = downloadFile("".concat(repoUrl).concat(fullZipPath), zipName), stdout = _a.stdout, stderr = _a.stderr, code = _a.code;
+                    // If doesn't exist, we try again, but with master.zip for the zip name.
+                    // Since that's the name generated from branch name.
+                    if (stderr.includes('404: Not Found') || code) {
+                        zipName = 'master.zip';
+                        _b = downloadFile("".concat(repoUrl).concat(zipPath).concat(zipName), zipName), stdout_1 = _b.stdout, stderr_1 = _b.stderr, code_1 = _b.code;
+                        if (stderr_1.includes('404: Not Found') || code_1) {
+                            errorCallback("".concat(repoUrl).concat(zipPath, " is not SASjs repository!"));
+                            return [2 /*return*/];
+                        }
+                    }
+                    zipWithoutExtension = zipName.replace('.zip', '');
+                    return [4 /*yield*/, (0, zip_1.extractZip)(zipName, "./", true)];
+                case 1:
+                    _c.sent();
+                    shelljs_1.default.cp('-r', "".concat(shelljs_1.default.ls('-d', "./*".concat(zipWithoutExtension))[0], "/."), folderPath);
+                    shelljs_1.default.rm('-rf', ["./*".concat(zipWithoutExtension)]);
+                    shelljs_1.default.rm('-rf', ["./".concat(zipName)]);
+                    return [4 /*yield*/, loadDocsSubmodule(docsUrl, folderPath, fullZipPath)];
+                case 2:
+                    _c.sent();
+                    shelljs_1.default.rm('-f', [path_1.default.join(folderPath, '.gitmodules')]);
+                    spinner.stop();
+                    if (installDependencies) {
+                        spinner.text = 'Installing dependencies...';
+                        spinner.start();
+                        shelljs_1.default.exec("cd \"".concat(folderPath, "\" && npm install"), {
+                            silent: true
+                        });
+                        spinner.stop();
+                    }
+                    return [2 /*return*/];
+            }
         });
-        spinner.stop();
-    }
+    });
 }
 /**
  * It will download and unzip `sasjs/docs` into newly created folder into `docs` subfolder
@@ -271,7 +294,7 @@ function createApp(folderPath, repoUrl, docsUrl, errorCallback, installDependenc
  * @param zipPath fixed path of where github puts zip for repo download
  */
 var loadDocsSubmodule = function (docsUrl, folderPath, zipPath) { return __awaiter(void 0, void 0, void 0, function () {
-    var docsFolderPath, zip;
+    var docsFolderPath;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -282,8 +305,9 @@ var loadDocsSubmodule = function (docsUrl, folderPath, zipPath) { return __await
                 if (!(_a.sent()))
                     docsFolderPath = "".concat(folderPath, "/docs"); // If not, we load submodule in root
                 downloadFile("".concat(docsUrl).concat(zipPath), 'main.zip');
-                zip = new adm_zip_1.default('main.zip');
-                zip.extractAllTo('./', true);
+                return [4 /*yield*/, (0, zip_1.extractZip)('main.zip', './', true)];
+            case 2:
+                _a.sent();
                 shelljs_1.default.cp('-r', "".concat(shelljs_1.default.ls('-d', "./*-main")[0], "/."), docsFolderPath);
                 shelljs_1.default.rm('-rf', ["./*-main"]);
                 shelljs_1.default.rm('-rf', ["./main.zip"]);

package/build/utils/zip.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Extracts a zip archive to the given directory.
+ *
+ * Replaces adm-zip's extractAllTo (GHSA-vwc7-r8mq-g2x9: extraction follows
+ * destination symlinks, allowing arbitrary file overwrite). This
+ * implementation never follows symlinks at the destination: every path
+ * component is checked with fs.lstatSync and extraction of an entry aborts
+ * if a symlink is found where a directory or file is expected.
+ *
+ * Directories mentioned only implicitly by entry paths are created; explicit
+ * directory entries are honoured. Unix file mode bits are preserved (needed
+ * by e.g. .git-hooks files in seed apps, which git requires to be
+ * executable). Overwriting of existing regular files is opt-in; existing
+ * symlinks are never written through.
+ *
+ * @param {string} zipPath - path of the zip archive to extract.
+ * @param {string} destDir - directory to extract into (created if missing).
+ * @param {boolean} overwrite - whether existing regular files are replaced.
+ */
+export declare const extractZip: (zipPath: string, destDir: string, overwrite?: boolean) => Promise<void>;

package/build/utils/zip.js

@@ -0,0 +1,277 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractZip = void 0;
+var fs_1 = __importDefault(require("fs"));
+var path_1 = __importDefault(require("path"));
+var yauzl_1 = require("yauzl");
+/**
+ * Extracts a zip archive to the given directory.
+ *
+ * Replaces adm-zip's extractAllTo (GHSA-vwc7-r8mq-g2x9: extraction follows
+ * destination symlinks, allowing arbitrary file overwrite). This
+ * implementation never follows symlinks at the destination: every path
+ * component is checked with fs.lstatSync and extraction of an entry aborts
+ * if a symlink is found where a directory or file is expected.
+ *
+ * Directories mentioned only implicitly by entry paths are created; explicit
+ * directory entries are honoured. Unix file mode bits are preserved (needed
+ * by e.g. .git-hooks files in seed apps, which git requires to be
+ * executable). Overwriting of existing regular files is opt-in; existing
+ * symlinks are never written through.
+ *
+ * @param {string} zipPath - path of the zip archive to extract.
+ * @param {string} destDir - directory to extract into (created if missing).
+ * @param {boolean} overwrite - whether existing regular files are replaced.
+ */
+var extractZip = function (zipPath_1, destDir_1) {
+    var args_1 = [];
+    for (var _i = 2; _i < arguments.length; _i++) {
+        args_1[_i - 2] = arguments[_i];
+    }
+    return __awaiter(void 0, __spreadArray([zipPath_1, destDir_1], __read(args_1), false), void 0, function (zipPath, destDir, overwrite) {
+        var zipfile, _a, _b, _c, entry, e_1_1;
+        var _d, e_1, _e, _f;
+        if (overwrite === void 0) { overwrite = false; }
+        return __generator(this, function (_g) {
+            switch (_g.label) {
+                case 0: return [4 /*yield*/, (0, yauzl_1.openPromise)(zipPath, {
+                        lazyEntries: true,
+                        decodeStrings: true,
+                        validateEntrySizes: true
+                    })];
+                case 1:
+                    zipfile = _g.sent();
+                    _g.label = 2;
+                case 2:
+                    _g.trys.push([2, , 16, 17]);
+                    _g.label = 3;
+                case 3:
+                    _g.trys.push([3, 9, 10, 15]);
+                    _a = true, _b = __asyncValues(zipfile.eachEntry());
+                    _g.label = 4;
+                case 4: return [4 /*yield*/, _b.next()];
+                case 5:
+                    if (!(_c = _g.sent(), _d = _c.done, !_d)) return [3 /*break*/, 8];
+                    _f = _c.value;
+                    _a = false;
+                    entry = _f;
+                    return [4 /*yield*/, extractEntry(zipfile, entry, destDir, overwrite)];
+                case 6:
+                    _g.sent();
+                    _g.label = 7;
+                case 7:
+                    _a = true;
+                    return [3 /*break*/, 4];
+                case 8: return [3 /*break*/, 15];
+                case 9:
+                    e_1_1 = _g.sent();
+                    e_1 = { error: e_1_1 };
+                    return [3 /*break*/, 15];
+                case 10:
+                    _g.trys.push([10, , 13, 14]);
+                    if (!(!_a && !_d && (_e = _b.return))) return [3 /*break*/, 12];
+                    return [4 /*yield*/, _e.call(_b)];
+                case 11:
+                    _g.sent();
+                    _g.label = 12;
+                case 12: return [3 /*break*/, 14];
+                case 13:
+                    if (e_1) throw e_1.error;
+                    return [7 /*endfinally*/];
+                case 14: return [7 /*endfinally*/];
+                case 15: return [3 /*break*/, 17];
+                case 16:
+                    zipfile.close();
+                    return [7 /*endfinally*/];
+                case 17: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.extractZip = extractZip;
+var extractEntry = function (zipfile, entry, destDir, overwrite) { return __awaiter(void 0, void 0, void 0, function () {
+    var entryPath, isDirectoryEntry, destPath, parents, destStat, readStream, mode;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                entryPath = entry.fileName;
+                isDirectoryEntry = entryPath.endsWith('/');
+                destPath = path_1.default.join(destDir, entryPath);
+                parents = path_1.default.dirname(destPath);
+                return [4 /*yield*/, ensureDirNoSymlink(destDir, parents)];
+            case 1:
+                _a.sent();
+                if (isDirectoryEntry) {
+                    // Explicit directory entry: create it (mode as-is; dirs are rwxr-xr-x by default).
+                    fs_1.default.mkdirSync(destPath, { recursive: true });
+                    return [2 /*return*/];
+                }
+                destStat = null;
+                try {
+                    destStat = fs_1.default.lstatSync(destPath);
+                }
+                catch (_b) {
+                    destStat = null;
+                }
+                if (destStat) {
+                    if (destStat.isSymbolicLink()) {
+                        throw new Error("Refusing to extract \"".concat(entryPath, "\": destination is a symbolic link."));
+                    }
+                    if (!destStat.isFile()) {
+                        throw new Error("Refusing to extract \"".concat(entryPath, "\": destination is not a regular file."));
+                    }
+                    if (!overwrite)
+                        return [2 /*return*/];
+                }
+                return [4 /*yield*/, zipfile.openReadStreamPromise(entry)];
+            case 2:
+                readStream = _a.sent();
+                return [4 /*yield*/, streamToFile(readStream, destPath)
+                    // Preserve unix mode bits (external attrs high 16 bits), e.g. the exec bit
+                    // on .git-hooks files in seed apps. Only entries created on a unix host
+                    // (versionMadeBy platform 3) are honoured: archives created on other
+                    // hosts (Windows, DOS, ...) leave these bits zero or repurpose them, and
+                    // chmod-ing a mode derived from them would give the file garbage
+                    // permissions.
+                ];
+            case 3:
+                _a.sent();
+                mode = entry.versionMadeBy >>> 8 === 3
+                    ? (entry.externalFileAttributes >>> 16) & 4095
+                    : 0;
+                if (mode)
+                    fs_1.default.chmodSync(destPath, mode);
+                return [2 /*return*/];
+        }
+    });
+}); };
+/**
+ * Creates dirPath (which must be at or under rootDir), creating parents as
+ * needed, and throws if any existing path component is a symbolic link.
+ *
+ * NOTE: the existsSync/lstatSync/mkdirSync sequence is inherently racy
+ * (TOCTOU) - a symlink swapped in between the check and the mkdir is
+ * traversed. Extraction is therefore strictly sequential, one entry at a
+ * time. Do not extract entries in parallel into a shared destDir without
+ * closing this window first.
+ */
+var ensureDirNoSymlink = function (rootDir, dirPath) { return __awaiter(void 0, void 0, void 0, function () {
+    var rootParts, targetParts, current, i, exists, stat;
+    return __generator(this, function (_a) {
+        rootParts = path_1.default.resolve(rootDir).split(path_1.default.sep);
+        targetParts = path_1.default.resolve(dirPath).split(path_1.default.sep);
+        current = rootParts[0] || path_1.default.sep;
+        for (i = 1; i < targetParts.length; i++) {
+            current = path_1.default.join(current, targetParts[i]);
+            exists = fs_1.default.existsSync(current);
+            if (exists) {
+                stat = fs_1.default.lstatSync(current);
+                if (stat.isSymbolicLink()) {
+                    throw new Error("Refusing to extract into \"".concat(current, "\": symbolic link in destination path."));
+                }
+                if (!stat.isDirectory()) {
+                    throw new Error("Cannot extract into \"".concat(current, "\": exists and is not a directory."));
+                }
+            }
+            else {
+                fs_1.default.mkdirSync(current, { recursive: false });
+            }
+        }
+        return [2 /*return*/];
+    });
+}); };
+var streamToFile = function (readStream, destPath) { return __awaiter(void 0, void 0, void 0, function () {
+    var writeStream;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                writeStream = fs_1.default.createWriteStream(destPath, {
+                    flags: 'w',
+                    mode: 438
+                });
+                return [4 /*yield*/, pipelinePromise(readStream, writeStream)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+var pipelinePromise = function (readable, writable) {
+    return new Promise(function (resolve, reject) {
+        readable.on('error', reject);
+        writable.on('error', reject);
+        writable.on('close', resolve);
+        readable.pipe(writable);
+    });
+};

package/package.json

@@ -73,7 +73,6 @@
     "@sasjs/core": "5.2.4",
     "@sasjs/lint": "2.5.0",
     "@sasjs/utils": "3.6.2",
-    "adm-zip": "0.6.0",
     "chalk": "4.1.2",
     "dotenv": "17.4.2",
     "find": "0.3.0",
@@ -89,13 +88,15 @@
     "shelljs": "0.10.0",
     "ssl-root-cas": "1.3.1",
     "xml": "1.0.1",
-    "yargs": "17.6.2"
+    "yargs": "17.6.2",
+    "yauzl": "3.4.0",
+    "yazl": "3.3.1"
   },
   "devDependencies": {
     "@babel/core": "7.29.7",
     "@babel/preset-env": "7.29.7",
     "@babel/preset-typescript": "7.29.7",
-    "@types/adm-zip": "0.5.8",
+    "@nogoo9/gitleaks": "8.30.1-post.2",
     "@types/debug": "4.1.13",
     "@types/find": "0.2.4",
     "@types/jest": "30.0.0",
@@ -106,6 +107,8 @@
     "@types/shelljs": "0.8.10",
     "@types/url-parse": "1.4.11",
     "@types/xml": "1.0.11",
+    "@types/yauzl": "3.4.0",
+    "@types/yazl": "3.3.1",
     "babel-jest": "30.5.1",
     "copyfiles": "2.4.1",
     "jest": "30.5.1",
@@ -124,5 +127,5 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "4.20.2"
+  "version": "4.20.3"
 }