@theia/filesystem 1.77.0-next.99 → 1.78.0-next.0

package/src/common/io.ts

@@ -22,9 +22,9 @@
 /* eslint-disable max-len */
 
 import URI from '@theia/core/lib/common/uri';
-import { BinaryBuffer } from '@theia/core/lib/common//buffer';
+import { BinaryBuffer } from '@theia/core/lib/common/buffer';
 import { CancellationToken, cancelled as canceled } from '@theia/core/lib/common/cancellation';
-import { FileSystemProviderWithOpenReadWriteCloseCapability, FileReadStreamOptions, ensureFileSystemProviderError, createFileSystemProviderError, FileSystemProviderErrorCode } from './files';
+import { FileSystemProviderWithOpenReadWriteCloseCapability, FileReadStreamOptions, ensureFileSystemProviderError, createFileSystemProviderError, FileSystemProviderErrorCode } from './files.js';
 import { WriteableStream, ErrorTransformer, DataTransformer } from '@theia/core/lib/common/stream';
 
 export interface CreateReadStreamOptions extends FileReadStreamOptions {

package/src/common/remote-file-system-provider.ts

@@ -25,7 +25,7 @@ import {
     hasOpenReadWriteCloseCapability, hasFileFolderCopyCapability, hasReadWriteCapability, hasAccessCapability,
     FileSystemProviderError, FileSystemProviderErrorCode, FileUpdateOptions, hasUpdateCapability, FileUpdateResult, FileReadStreamOptions, hasFileReadStreamCapability,
     ReadOnlyMessageFileSystemProvider
-} from './files';
+} from './files.js';
 import { RpcServer, RpcProxy, RpcProxyFactory } from '@theia/core/lib/common/messaging/proxy-factory';
 import { ApplicationError } from '@theia/core/lib/common/application-error';
 import { Deferred } from '@theia/core/lib/common/promise-util';

package/src/electron-browser/file-dialog/electron-file-dialog-module.ts

@@ -15,8 +15,8 @@
 // *****************************************************************************
 
 import { ContainerModule } from '@theia/core/shared/inversify';
-import { ElectronFileDialogService } from './electron-file-dialog-service';
-import { FileDialogService } from '../../browser';
+import { ElectronFileDialogService } from './electron-file-dialog-service.js';
+import { FileDialogService } from '../../browser/index.js';
 
 export default new ContainerModule((bind, _unbind, _isBound, rebind) => {
     bind(ElectronFileDialogService).toSelf().inSingletonScope();

package/src/electron-browser/file-dialog/electron-file-dialog-service.spec.ts

@@ -20,9 +20,9 @@ let disableJSDOM = enableJSDOM();
 import { expect } from 'chai';
 import { FileUri } from '@theia/core/lib/common/file-uri';
 import URI from '@theia/core/lib/common/uri';
-import { OpenFileDialogProps } from '../../browser/file-dialog';
-import { OpenDialogOptions } from '../../electron-common/electron-api';
-import { ElectronFileDialogService } from './electron-file-dialog-service';
+import { OpenFileDialogProps, SaveFileDialogProps } from '../../browser/file-dialog/index.js';
+import { OpenDialogOptions, SaveDialogOptions } from '../../electron-common/electron-api.js';
+import { ElectronFileDialogService } from './electron-file-dialog-service.js';
 
 disableJSDOM();
 
@@ -30,6 +30,9 @@ class TestElectronFileDialogService extends ElectronFileDialogService {
     override toOpenDialogOptions(uri: URI, props: OpenFileDialogProps): OpenDialogOptions {
         return super.toOpenDialogOptions(uri, props);
     }
+    override toSaveDialogOptions(uri: URI, props: SaveFileDialogProps): SaveDialogOptions {
+        return super.toSaveDialogOptions(uri, props);
+    }
 }
 
 describe('ElectronFileDialogService', () => {
@@ -54,4 +57,28 @@ describe('ElectronFileDialogService', () => {
             { name: 'Theia Workspace', extensions: ['theia-workspace'] }
         ]);
     });
+
+    describe('windowName forwarding', () => {
+        it('should pass windowName from targetWindow for open dialog', () => {
+            const targetWindow = { name: '123-secondaryWindow-0' } as Window;
+            const options = new TestElectronFileDialogService().toOpenDialogOptions(uri, { title: 'Open', canSelectFiles: true, targetWindow });
+            expect(options.windowName).to.equal('123-secondaryWindow-0');
+        });
+
+        it('should leave windowName undefined when no targetWindow is set for open dialog', () => {
+            const options = new TestElectronFileDialogService().toOpenDialogOptions(uri, { title: 'Open', canSelectFiles: true });
+            expect(options.windowName).to.be.undefined;
+        });
+
+        it('should pass windowName from targetWindow for save dialog', () => {
+            const targetWindow = { name: '123-secondaryWindow-0' } as Window;
+            const options = new TestElectronFileDialogService().toSaveDialogOptions(uri, { title: 'Save', targetWindow });
+            expect(options.windowName).to.equal('123-secondaryWindow-0');
+        });
+
+        it('should leave windowName undefined when no targetWindow is set for save dialog', () => {
+            const options = new TestElectronFileDialogService().toSaveDialogOptions(uri, { title: 'Save' });
+            expect(options.windowName).to.be.undefined;
+        });
+    });
 });

package/src/electron-browser/file-dialog/electron-file-dialog-service.ts

@@ -18,9 +18,9 @@ import { inject, injectable } from '@theia/core/shared/inversify';
 import URI from '@theia/core/lib/common/uri';
 import { MaybeArray } from '@theia/core/lib/common/types';
 import { MessageService } from '@theia/core/lib/common/message-service';
-import { FileStat } from '../../common/files';
-import { FileAccess } from '../../common/filesystem';
-import { DefaultFileDialogService, OpenFileDialogProps, SaveFileDialogProps } from '../../browser/file-dialog';
+import { FileStat } from '../../common/files.js';
+import { FileAccess } from '../../common/filesystem.js';
+import { DefaultFileDialogService, OpenFileDialogProps, SaveFileDialogProps } from '../../browser/file-dialog/index.js';
 //
 // We are OK to use this here because the electron backend and frontend are on the same host.
 // If required, we can move this single service (and its module) to a dedicated Theia extension,
@@ -29,7 +29,7 @@ import { DefaultFileDialogService, OpenFileDialogProps, SaveFileDialogProps } fr
 //
 // eslint-disable-next-line @theia/runtime-import-check
 import { FileUri } from '@theia/core/lib/common/file-uri';
-import { OpenDialogOptions, SaveDialogOptions } from '../../electron-common/electron-api';
+import { OpenDialogOptions, SaveDialogOptions } from '../../electron-common/electron-api.js';
 
 import '@theia/core/lib/electron-common/electron-api';
 
@@ -118,7 +118,8 @@ export class ElectronFileDialogService extends DefaultFileDialogService {
 
     protected toOpenDialogOptions(uri: URI, props: OpenFileDialogProps): OpenDialogOptions {
         const result: OpenDialogOptions = {
-            path: FileUri.fsPath(uri)
+            path: FileUri.fsPath(uri),
+            windowName: props.targetWindow?.name
         };
 
         result.title = props.title;
@@ -152,7 +153,8 @@ export class ElectronFileDialogService extends DefaultFileDialogService {
         }
 
         const result: SaveDialogOptions = {
-            path: FileUri.fsPath(uri)
+            path: FileUri.fsPath(uri),
+            windowName: props.targetWindow?.name
         };
 
         result.title = props.title;

package/src/electron-browser/preload.ts

@@ -13,7 +13,7 @@
 //
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
-import { CHANNEL_SHOW_OPEN, CHANNEL_SHOW_SAVE, OpenDialogOptions, SaveDialogOptions, TheiaFilesystemAPI } from '../electron-common/electron-api';
+import { CHANNEL_SHOW_OPEN, CHANNEL_SHOW_SAVE, OpenDialogOptions, SaveDialogOptions, TheiaFilesystemAPI } from '../electron-common/electron-api.js';
 
 // eslint-disable-next-line import/no-extraneous-dependencies
 import { ipcRenderer, contextBridge } from '@theia/core/electron-shared/electron';

package/src/electron-common/electron-api.ts

@@ -29,6 +29,8 @@ export interface OpenDialogOptions {
     openFolders?: boolean;
     selectMany?: boolean;
     filters?: FileFilter[];
+    /** Name of the target window for parenting the dialog. If omitted, the sender's window is used. */
+    windowName?: string;
 }
 
 export interface SaveDialogOptions {
@@ -38,6 +40,8 @@ export interface SaveDialogOptions {
     buttonLabel?: string,
     modal?: boolean,
     filters?: FileFilter[];
+    /** Name of the target window for parenting the dialog. If omitted, the sender's window is used. */
+    windowName?: string;
 }
 
 export interface TheiaFilesystemAPI {

package/src/electron-main/electron-api-main.ts

@@ -18,7 +18,7 @@ import { injectable } from '@theia/core/shared/inversify';
 
 import { ElectronMainApplication, ElectronMainApplicationContribution } from '@theia/core/lib/electron-main/electron-main-application';
 import { MaybePromise } from '@theia/core';
-import { CHANNEL_SHOW_OPEN, CHANNEL_SHOW_SAVE, OpenDialogOptions, SaveDialogOptions } from '../electron-common/electron-api';
+import { CHANNEL_SHOW_OPEN, CHANNEL_SHOW_SAVE, OpenDialogOptions, SaveDialogOptions } from '../electron-common/electron-api.js';
 import { ipcMain, OpenDialogOptions as ElectronOpenDialogOptions, SaveDialogOptions as ElectronSaveDialogOptions, BrowserWindow, dialog }
     from '@theia/core/electron-shared/electron';
 
@@ -50,7 +50,9 @@ export class ElectronApi implements ElectronMainApplicationContribution {
             };
 
             if (options.modal) {
-                const win = BrowserWindow.fromWebContents(event.sender);
+                const win = options.windowName
+                    ? BrowserWindow.getAllWindows().find(w => w.webContents.mainFrame.name === options.windowName)
+                    : BrowserWindow.fromWebContents(event.sender);
                 if (win) {
                     return (await dialog.showOpenDialog(win, dialogOpts)).filePaths;
                 }
@@ -66,7 +68,9 @@ export class ElectronApi implements ElectronMainApplicationContribution {
                 title: options.title
             };
             if (options.modal) {
-                const win = BrowserWindow.fromWebContents(event.sender);
+                const win = options.windowName
+                    ? BrowserWindow.getAllWindows().find(w => w.webContents.mainFrame.name === options.windowName)
+                    : BrowserWindow.fromWebContents(event.sender);
                 if (win) {
                     return (await dialog.showSaveDialog(win, dialogOpts)).filePath;
                 }

package/src/electron-main/electron-main-module.ts

@@ -15,7 +15,7 @@
 // *****************************************************************************
 import { ContainerModule } from '@theia/core/shared/inversify';
 import { ElectronMainApplicationContribution } from '@theia/core/lib/electron-main/electron-main-application';
-import { ElectronApi } from './electron-api-main';
+import { ElectronApi } from './electron-api-main.js';
 
 export default new ContainerModule(bind => {
     bind(ElectronApi).toSelf().inSingletonScope();

package/src/node/archive/archive-extractor.spec.ts

@@ -0,0 +1,359 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import * as fs from 'fs';
+import { randomBytes } from 'crypto';
+import * as os from 'os';
+import * as path from 'path';
+import { expect } from 'chai';
+import * as sinon from 'sinon';
+import { ILogger } from '@theia/core/lib/common/logger';
+import { ArchiveExtractorImpl, ArchiveFormat } from './archive-extractor.js';
+import { createTestTar, createTestZip } from './test/test-archives.js';
+
+const isWindows = process.platform === 'win32';
+
+describe('ArchiveExtractorImpl', () => {
+
+    let workspace: string;
+    let destination: string;
+    let outside: string;
+    let warnings: string[];
+
+    class TestArchiveExtractor extends ArchiveExtractorImpl {
+        override readonly logger = { warn: (message: string) => warnings.push(message) } as unknown as ILogger;
+    }
+    const extractor = new TestArchiveExtractor();
+
+    beforeEach(async () => {
+        workspace = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'archive-extractor-'));
+        destination = path.join(workspace, 'out');
+        outside = path.join(workspace, 'outside');
+        await fs.promises.mkdir(outside);
+        warnings = [];
+    });
+
+    afterEach(async () => {
+        await fs.promises.rm(workspace, { recursive: true, force: true });
+    });
+
+    async function expectRejection(promise: Promise<unknown>, message: RegExp): Promise<void> {
+        try {
+            await promise;
+        } catch (error) {
+            expect(String(error)).to.match(message);
+            return;
+        }
+        expect.fail('Expected the promise to be rejected');
+    }
+
+    async function listFiles(directory: string): Promise<string[]> {
+        const entries = await fs.promises.readdir(directory, { recursive: true });
+        return entries.map(entry => entry.split(path.sep).join('/')).sort();
+    }
+
+    /** Creating a file link on Windows requires elevated rights or developer mode. */
+    async function createFileLink(target: string, link: string): Promise<boolean> {
+        try {
+            await fs.promises.symlink(target, link, 'file');
+            return true;
+        } catch (error) {
+            if (isWindows && (error as NodeJS.ErrnoException).code === 'EPERM') {
+                return false;
+            }
+            throw error;
+        }
+    }
+
+    async function writeArchive(name: string, content: Buffer): Promise<string> {
+        const archivePath = path.join(workspace, name);
+        await fs.promises.writeFile(archivePath, content);
+        return archivePath;
+    }
+
+    const formats: { name: string, create: (entries: { name: string, type?: 'file' | 'directory', mode?: number, data?: string }[]) => Promise<Buffer> }[] = [
+        {
+            name: 'zip',
+            create: async entries => createTestZip(entries.map(entry => ({
+                name: entry.type === 'directory' ? entry.name + '/' : entry.name,
+                mode: (entry.type === 'directory' ? 0o040000 : 0o100000) | (entry.mode ?? (entry.type === 'directory' ? 0o755 : 0o644)),
+                data: entry.data
+            })))
+        },
+        { name: 'tar', create: entries => createTestTar(entries) },
+        { name: 'tgz', create: entries => createTestTar(entries, true) }
+    ];
+
+    for (const format of formats) {
+        describe(format.name, () => {
+
+            it('extracts files and directories from a path', async () => {
+                const archive = await writeArchive(`archive.${format.name}`, await format.create([
+                    { name: 'extension', type: 'directory' },
+                    { name: 'extension/package.json', data: '{}' },
+                    { name: 'extension/nested/file.txt', data: 'content' }
+                ]));
+                const entries = await extractor.extract(archive, destination);
+                expect(entries.map(entry => `${entry.type}:${entry.path}`)).to.deep.equal([
+                    'directory:extension',
+                    'file:extension/package.json',
+                    'file:extension/nested/file.txt'
+                ]);
+                expect(await fs.promises.readFile(path.join(destination, 'extension', 'nested', 'file.txt'), 'utf8')).to.equal('content');
+            });
+
+            it('extracts from a buffer', async () => {
+                await extractor.extract(await format.create([{ name: 'file.txt', data: 'content' }]), destination);
+                expect(await fs.promises.readFile(path.join(destination, 'file.txt'), 'utf8')).to.equal('content');
+            });
+
+            it('reads the selected files without extracting', async () => {
+                const archive = await format.create([
+                    { name: 'extension/package.json', data: '{"name":"test"}' },
+                    { name: 'extension/README.md', data: 'readme' }
+                ]);
+                const files = await extractor.readFiles(archive, { filter: entryPath => entryPath === 'extension/package.json' });
+                expect(files.map(file => [file.path, file.data.toString('utf8')])).to.deep.equal([['extension/package.json', '{"name":"test"}']]);
+                expect(fs.existsSync(destination)).to.be.false;
+            });
+
+            (isWindows ? it.skip : it)('keeps permission bits but strips setuid, setgid and sticky bits', async () => {
+                const entries = await extractor.extract(await format.create([
+                    { name: 'run.sh', mode: 0o755, data: '#!/bin/sh' },
+                    { name: 'setuid', mode: 0o7755, data: 'evil' }
+                ]), destination);
+                expect(entries.map(entry => entry.mode)).to.deep.equal([0o755, 0o755]);
+                expect((await fs.promises.stat(path.join(destination, 'run.sh'))).mode & 0o7777).to.equal(0o755 & ~process.umask());
+                expect((await fs.promises.stat(path.join(destination, 'setuid'))).mode & 0o7000).to.equal(0);
+            });
+
+            it('rejects an entry that leaves the destination', async () => {
+                const archive = await format.create([{ name: '../outside/evil.txt', data: 'evil' }]);
+                await expectRejection(extractor.extract(archive, destination), /invalid relative path|leaves the extraction directory/);
+                expect(await listFiles(outside)).to.be.empty;
+            });
+
+            it('rejects an entry with an absolute path', async () => {
+                const target = path.join(outside, 'evil.txt').split(path.sep).join('/');
+                await expectRejection(extractor.extract(await format.create([{ name: target, data: 'evil' }]), destination), /absolute path/);
+                expect(await listFiles(outside)).to.be.empty;
+            });
+
+            it('does not write through a symlinked directory in the destination', async () => {
+                await fs.promises.mkdir(destination);
+                await fs.promises.symlink(outside, path.join(destination, 'link'), 'junction');
+                await expectRejection(extractor.extract(await format.create([{ name: 'link/evil.txt', data: 'evil' }]), destination), /leaves the extraction directory/);
+                expect(await listFiles(outside)).to.be.empty;
+            });
+
+            it('does not create directories through a symlinked directory in the destination', async () => {
+                await fs.promises.mkdir(destination);
+                await fs.promises.symlink(outside, path.join(destination, 'link'), 'junction');
+                await expectRejection(extractor.extract(await format.create([{ name: 'link/new-directory/evil.txt', data: 'evil' }]), destination),
+                    /leaves the extraction directory/);
+                expect(await listFiles(outside)).to.be.empty;
+            });
+
+            it('does not write through a symlinked file in the destination', async function (): Promise<void> {
+                const target = path.join(outside, 'target.txt');
+                await fs.promises.writeFile(target, 'original');
+                await fs.promises.mkdir(destination);
+                if (!await createFileLink(target, path.join(destination, 'file.txt'))) {
+                    this.skip();
+                }
+                await expectRejection(extractor.extract(await format.create([{ name: 'file.txt', data: 'evil' }]), destination), /written through a link/);
+                expect(await fs.promises.readFile(target, 'utf8')).to.equal('original');
+            });
+
+            it('does not write a file whose existing target cannot be inspected', async () => {
+                await fs.promises.mkdir(destination);
+                const target = path.join(await fs.promises.realpath(destination), 'file.txt');
+                await fs.promises.writeFile(target, 'original');
+                const lstat = sinon.stub(fs.promises, 'lstat').callThrough();
+                lstat.withArgs(target).rejects(Object.assign(new Error('EACCES: permission denied'), { code: 'EACCES' }));
+                try {
+                    await expectRejection(extractor.extract(await format.create([{ name: 'file.txt', data: 'evil' }]), destination), /EACCES/);
+                } finally {
+                    lstat.restore();
+                }
+                expect(await fs.promises.readFile(target, 'utf8')).to.equal('original');
+            });
+
+            it('accepts names that start with two dots', async () => {
+                await extractor.extract(await format.create([
+                    { name: '..config/settings.json', data: '{}' },
+                    { name: '..hidden', data: 'hidden' }
+                ]), destination);
+                expect(await listFiles(destination)).to.deep.equal(['..config', '..config/settings.json', '..hidden']);
+            });
+
+            it('creates parent directories that have no entry of their own', async () => {
+                const entries = await extractor.extract(await format.create([{ name: 'a/b/c.txt', data: 'content' }]), destination);
+                expect(entries.map(entry => entry.path)).to.deep.equal(['a/b/c.txt']);
+                expect(await fs.promises.readFile(path.join(destination, 'a', 'b', 'c.txt'), 'utf8')).to.equal('content');
+            });
+
+            it('overwrites existing files in the destination', async () => {
+                await fs.promises.mkdir(destination);
+                await fs.promises.writeFile(path.join(destination, 'file.txt'), 'old content that is longer');
+                await extractor.extract(await format.create([{ name: 'file.txt', data: 'new' }]), destination);
+                expect(await fs.promises.readFile(path.join(destination, 'file.txt'), 'utf8')).to.equal('new');
+            });
+
+            it('extracts long entry names', async () => {
+                const longName = ['a'.repeat(80), 'b'.repeat(80), 'c'.repeat(80), 'file.txt'].join('/');
+                await extractor.extract(await format.create([{ name: longName, data: 'long' }]), destination);
+                expect(await fs.promises.readFile(path.join(destination, ...longName.split('/')), 'utf8')).to.equal('long');
+            });
+
+            it('extracts a large file', async () => {
+                const data = randomBytes(3 * 1024 * 1024).toString('base64');
+                await extractor.extract(await format.create([{ name: 'large.txt', data }]), destination);
+                expect(await fs.promises.readFile(path.join(destination, 'large.txt'), 'utf8')).to.equal(data);
+            });
+
+            it('rejects a truncated archive', async () => {
+                const archive = await format.create([{ name: 'file.txt', data: randomBytes(64 * 1024).toString('base64') }]);
+                await expectRejection(extractor.extract(archive.subarray(0, archive.length / 2), destination), /end of (central directory|data|file)/i);
+            });
+
+            it('extracts an empty archive', async () => {
+                const entries = await extractor.extract(await format.create([]), destination, { format: format.name as ArchiveFormat });
+                expect(entries).to.be.empty;
+                expect(await listFiles(destination)).to.be.empty;
+            });
+
+            (process.platform === 'linux' ? it : it.skip)('closes the archive file after a failed extraction', async () => {
+                const archive = await writeArchive(`archive.${format.name}`, await format.create([
+                    { name: 'file.txt', data: 'content' },
+                    { name: '../outside/evil.txt', data: 'evil' }
+                ]));
+                const openBefore = (await fs.promises.readdir('/proc/self/fd')).length;
+                await expectRejection(extractor.extract(archive, destination), /invalid relative path|leaves the extraction directory/);
+                expect((await fs.promises.readdir('/proc/self/fd')).length).to.equal(openBefore);
+            });
+        });
+    }
+
+    describe('zip entries', () => {
+
+        (isWindows ? it.skip : it)('uses default permissions for entries without a Unix mode', async () => {
+            const entries = await extractor.extract(createTestZip([{ name: 'file.txt', mode: 0, data: 'content' }]), destination);
+            expect(entries.map(entry => entry.mode)).to.deep.equal([undefined]);
+            expect((await fs.promises.stat(path.join(destination, 'file.txt'))).mode & 0o777).to.equal(0o666 & ~process.umask());
+        });
+
+        it('accepts backslashes as separators', async () => {
+            await extractor.extract(createTestZip([{ name: 'dir\\file.txt', data: 'content' }]), destination);
+            expect(await listFiles(destination)).to.deep.equal(['dir', 'dir/file.txt']);
+        });
+
+        it('rejects an entry that leaves the destination with backslashes', async () => {
+            await expectRejection(extractor.extract(createTestZip([{ name: '..\\outside\\evil.txt', data: 'evil' }]), destination),
+                /invalid relative path|leaves the extraction directory/);
+            expect(await listFiles(outside)).to.be.empty;
+        });
+    });
+
+    describe('zip links', () => {
+
+        it('skips a symlink entry', async () => {
+            const entries = await extractor.extract(createTestZip([
+                { name: 'link', mode: 0o120777, data: outside },
+                { name: 'file.txt', data: 'content' }
+            ]), destination);
+            expect(entries.map(entry => entry.path)).to.deep.equal(['file.txt']);
+            expect(await listFiles(destination)).to.deep.equal(['file.txt']);
+            expect(warnings.join()).to.contain('link');
+        });
+
+        it('keeps a file inside the destination when it follows a symlink entry of the same name', async () => {
+            await extractor.extract(createTestZip([
+                { name: 'link', mode: 0o120777, data: outside },
+                { name: 'link/evil.txt', data: 'evil' }
+            ]), destination);
+            expect(await listFiles(destination)).to.deep.equal(['link', 'link/evil.txt']);
+            expect(await listFiles(outside)).to.be.empty;
+        });
+    });
+
+    describe('tar links', () => {
+
+        it('skips a chain of symlink entries', async () => {
+            await extractor.extract(await createTestTar([
+                { name: 'a', type: 'symlink', linkname: '..' },
+                { name: 'a/b', type: 'symlink', linkname: '../outside' },
+                { name: 'a/b/evil.txt', data: 'evil' }
+            ]), destination);
+            expect(await listFiles(destination)).to.deep.equal(['a', 'a/b', 'a/b/evil.txt']);
+            expect(await listFiles(outside)).to.be.empty;
+        });
+
+        it('skips a hardlink entry', async () => {
+            const target = path.join(outside, 'secret.txt');
+            await fs.promises.writeFile(target, 'secret');
+            const entries = await extractor.extract(await createTestTar([
+                { name: 'secret.txt', type: 'link', linkname: target },
+                { name: 'file.txt', data: 'content' }
+            ]), destination);
+            expect(entries.map(entry => entry.path)).to.deep.equal(['file.txt']);
+            expect(await listFiles(destination)).to.deep.equal(['file.txt']);
+            expect(warnings.join()).to.contain('secret.txt');
+        });
+
+        it('skips special entries', async () => {
+            const entries = await extractor.extract(await createTestTar([
+                { name: 'pipe', type: 'fifo' },
+                { name: 'file.txt', data: 'content' }
+            ]), destination);
+            expect(entries.map(entry => entry.path)).to.deep.equal(['file.txt']);
+        });
+
+        it('reports links that are skipped while reading files', async () => {
+            const files = await extractor.readFiles(await createTestTar([
+                { name: 'link', type: 'symlink', linkname: '/etc/passwd' },
+                { name: 'file.txt', data: 'content' }
+            ]));
+            expect(files.map(file => file.path)).to.deep.equal(['file.txt']);
+            expect(warnings.join()).to.contain('link');
+        });
+
+        it('reports skipped entries on the console without a logger', async () => {
+            const warn = sinon.stub(console, 'warn');
+            try {
+                await new ArchiveExtractorImpl().extract(await createTestTar([
+                    { name: 'link', type: 'symlink', linkname: '/etc/passwd' },
+                    { name: 'file.txt', data: 'content' }
+                ]), destination);
+                expect(warn.calledOnceWith('Skipped 1 link or special entries of archive: link')).to.be.true;
+            } finally {
+                warn.restore();
+            }
+        });
+    });
+
+    it('rejects an unsupported format', async () => {
+        await expectRejection(extractor.extract(Buffer.from('not an archive'), destination), /Unsupported archive format/);
+    });
+
+    it('rejects a header that only resembles a zip signature', async () => {
+        await expectRejection(extractor.extract(Buffer.from('PK\x03\x06 not an archive', 'latin1'), destination), /Unsupported archive format/);
+    });
+
+    it('uses the given format instead of detecting it', async () => {
+        await expectRejection(extractor.extract(createTestZip([{ name: 'file.txt' }]), destination, { format: 'tgz' }), /incorrect header check/);
+    });
+});