@tryghost/zip 1.1.35 → 1.1.37

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2013-2022 Ghost Foundation
+Copyright (c) 2013-2023 Ghost Foundation
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -47,4 +47,4 @@ Follow the instructions for the top-level repo.
 
 # Copyright & License
 
-Copyright (c) 2013-2022 Ghost Foundation - Released under the [MIT license](LICENSE).
+Copyright (c) 2013-2023 Ghost Foundation - Released under the [MIT license](LICENSE).

package/lib/extract.js

@@ -1,5 +1,22 @@
+const errors = require('@tryghost/errors');
+
 const defaultOptions = {};
 
+function throwOnSymlinks(entry) {
+    // Check if symlink
+    const mode = (entry.externalFileAttributes >> 16) & 0xFFFF;
+    // check if it's a symlink or dir (using stat mode constants)
+    const IFMT = 61440;
+    const IFLNK = 40960;
+    const symlink = (mode & IFMT) === IFLNK;
+
+    if (symlink) {
+        throw new errors.UnsupportedMediaTypeError({
+            message: 'Symlinks in ZIP-files are not allowed'
+        });
+    }
+}
+
 /**
  * Extract
  *
@@ -19,6 +36,15 @@ module.exports = (zipToExtract, destination, options) => {
 
     opts.dir = destination;
 
+    if (opts.onEntry) {
+        opts.onEntry = (entry, zipfile) => {
+            throwOnSymlinks(entry);
+            options.onEntry(entry, zipfile);
+        };
+    } else {
+        opts.onEntry = throwOnSymlinks;
+    }
+
     return extract(zipToExtract, opts).then(() => {
         return {path: destination};
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryghost/zip",
-  "version": "1.1.35",
+  "version": "1.1.37",
   "repository": "https://github.com/TryGhost/framework/tree/main/packages/zip",
   "author": "Ghost Foundation",
   "license": "MIT",
@@ -26,9 +26,10 @@
     "sinon": "15.0.4"
   },
   "dependencies": {
+    "@tryghost/errors": "^1.2.26",
     "archiver": "^5.0.0",
     "extract-zip": "^2.0.1",
-    "fs-extra": "^10.0.0"
+    "fs-extra": "^11.0.0"
   },
-  "gitHead": "4bf425a83dabe8e70ee28dffa37cf678b640068e"
+  "gitHead": "a8099b9b00a5236dec93250593606bdd2a746fef"
 }