@zip.js/zip.js 2.8.49 → 2.8.50

package/lib/core/zip-fs.js

@@ -26,7 +26,7 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* global WritableStream */
+/* global WritableStream, AbortController */
 // deno-lint-ignore-file no-this-alias
 
 import {
@@ -71,6 +71,7 @@ import { toCompatibleReadable, toCompatibleWritable } from "./util/compatible-st
 
 const ERR_ENTRY_EXISTS = "Entry filename already exists";
 const ERR_READABLE_CONSUMED = "Readable stream already consumed";
+const ERR_ABORT_EXPORT = "zipjs-abort-export";
 const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 const INTERPRETED_EXTRA_FIELD_TYPES = new Set([
 	EXTRAFIELD_TYPE_ZIP64,
@@ -179,8 +180,9 @@ class ZipFileEntry extends ZipEntry {
 			const uncompressedSize = zipEntry.data ? zipEntry.data.uncompressedSize : reader.size;
 			await Promise.all([initStream(reader), initStream(writer, uncompressedSize)]);
 			const { readable } = reader;
+			const { signal } = options;
 			zipEntry.uncompressedSize = reader.size;
-			await toCompatibleReadable(readable).pipeTo(toCompatibleWritable(writer.writable));
+			await toCompatibleReadable(readable).pipeTo(toCompatibleWritable(writer.writable), { signal });
 			return writer.getData ? writer.getData() : writer.writable;
 		}
 	}
@@ -447,7 +449,7 @@ class ZipDirectoryEntry extends ZipEntry {
 		for (const entry of entries) {
 			let parent = this;
 			try {
-				const path = entry.filename.split("/");
+				const path = entry.filename.split("/").filter(pathPart => pathPart != "" && pathPart != ".");
 				const name = path.pop();
 				path.forEach(pathPart => {
 					const previousParent = parent;
@@ -823,6 +825,39 @@ function detach(entry) {
 	}
 }
 
+function forwardAbort(signal, abortController) {
+	if (!signal) {
+		return () => { };
+	}
+	if (signal.aborted) {
+		abortController.abort(signal.reason);
+		return () => { };
+	}
+	const abort = () => abortController.abort(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	return () => signal.removeEventListener("abort", abort);
+}
+
+function isExportAborted(error) {
+	return Boolean(error) && error.message == ERR_ABORT_EXPORT;
+}
+
+function aggregateEntryErrors(errors) {
+	const [error] = errors;
+	const otherErrors = errors
+		.slice(1)
+		.flatMap(otherError => [otherError, ...(otherError && otherError.entryErrors || [])])
+		.filter(otherError => otherError !== error);
+	if (otherErrors.length) {
+		try {
+			error.entryErrors = [...(error.entryErrors || []), ...otherErrors];
+		} catch {
+			// ignored
+		}
+	}
+	return error;
+}
+
 function getUserExtraField(extraField) {
 	if (extraField) {
 		const userExtraField = new Map();
@@ -943,8 +978,9 @@ async function exportZip(zipWriter, entry, totalSize, options, readers) {
 function addFileSystemHandle(zipEntry, handle, options) {
 	return addFile(zipEntry, handle, []);
 
-	async function addFile(parentEntry, handle, addedEntries) {
+	async function addFile(parentEntry, handle, addedEntries, parentName = "") {
 		if (handle) {
+			const entryName = parentName ? parentName + "/" + handle.name : handle.name;
 			try {
 				if (handle.isFile || handle.isDirectory) {
 					handle = await transformToFileSystemhandle(handle);
@@ -966,12 +1002,18 @@ function addFileSystemHandle(zipEntry, handle, options) {
 					const directoryEntry = parentEntry.addDirectory(handle.name);
 					addedEntries.push(directoryEntry);
 					for await (const childHandle of handle.values()) {
-						await addFile(directoryEntry, childHandle, addedEntries);
+						await addFile(directoryEntry, childHandle, addedEntries, entryName);
 					}
 				}
 			} catch (error) {
-				const message = error.message + (handle ? " (" + handle.name + ")" : "");
-				throw new Error(message, { cause: error });
+				try {
+					if (error.entryName === UNDEFINED_VALUE) {
+						error.entryName = entryName;
+					}
+				} catch {
+					// ignored
+				}
+				throw error;
 			}
 		}
 		return addedEntries;
@@ -981,15 +1023,32 @@ function addFileSystemHandle(zipEntry, handle, options) {
 async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 	const totalSize = getTotalSize([zipEntry], "uncompressedSize");
 	const writtenSizes = new Map();
-	await exportChildren(zipEntry, directoryHandle);
+	const abortController = new AbortController();
+	const { signal } = abortController;
+	const releaseSignal = forwardAbort(options.signal, abortController);
+	const exportedEntryNames = [];
+	try {
+		await exportChildren(zipEntry, directoryHandle);
+	} catch (error) {
+		try {
+			error.exportedEntryNames = exportedEntryNames;
+		} catch {
+			// ignored
+		}
+		throw error;
+	} finally {
+		releaseSignal();
+	}
 	return directoryHandle;
 
 	async function exportChildren(entry, parentHandle) {
 		if (options.concurrent) {
 			const results = await Promise.allSettled(entry.children.map(child => exportChild(child, parentHandle)));
-			const failedResult = results.find(result => result.status == "rejected");
-			if (failedResult) {
-				throw failedResult.reason;
+			const rejectedResults = results.filter(result => result.status == "rejected");
+			if (rejectedResults.length) {
+				const failedResults = rejectedResults.filter(result => !isExportAborted(result.reason));
+				const reportedResults = failedResults.length ? failedResults : rejectedResults;
+				throw aggregateEntryErrors(reportedResults.map(result => result.reason));
 			}
 		} else {
 			for (const child of entry.children) {
@@ -999,6 +1058,12 @@ async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 	}
 
 	async function exportChild(child, parentHandle) {
+		if (signal.aborted) {
+			if (isExportAborted(signal.reason)) {
+				return;
+			}
+			throw signal.reason;
+		}
 		try {
 			if (child.directory) {
 				const childDirectoryHandle = await parentHandle.getDirectoryHandle(child.name, { create: true });
@@ -1007,6 +1072,7 @@ async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 				const fileHandle = await parentHandle.getFileHandle(child.name, { create: true });
 				const writable = await fileHandle.createWritable();
 				await child.getData({ writable }, Object.assign({}, options, {
+					signal,
 					onprogress: async progress => {
 						if (options.onprogress) {
 							writtenSizes.set(child.id, progress);
@@ -1018,9 +1084,19 @@ async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 						}
 					}
 				}));
+				exportedEntryNames.push(child.getRelativeName(zipEntry));
 			}
 		} catch (error) {
-			throw new Error(error.message + (child ? " (" + child.name + ")" : ""), { cause: error });
+			abortController.abort(new Error(ERR_ABORT_EXPORT));
+			try {
+				if (error.entryName === UNDEFINED_VALUE) {
+					error.entryName = child.getRelativeName(zipEntry);
+					error.entryId = child.id;
+				}
+			} catch {
+				// ignored
+			}
+			throw error;
 		}
 	}
 }

package/lib/core/zip-reader.js

@@ -88,6 +88,8 @@ import {
 	FILE_ATTR_UNIX_SETUID_MASK,
 	FILE_ATTR_UNIX_SETGID_MASK,
 	FILE_ATTR_UNIX_STICKY_MASK,
+	NUMBER_TYPE,
+	STRING_TYPE,
 	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
@@ -150,8 +152,12 @@ import {
 	OPTION_CHECK_CRC32,
 	OPTION_CHECK_AUTHENTICATION_CODE,
 	OPTION_STRICTNESS,
+	OPTION_FILENAME_VALIDATION,
+	OPTION_NORMALIZE_FILENAME,
 	OPTION_MAX_APPENDED_DATA_SIZE,
 	OPTION_DECRYPT_CENTRAL_DIRECTORY,
+	TEXT_TYPE_FILENAME,
+	TEXT_TYPE_COMMENT,
 	STRICTNESS_STRICT,
 	STRICTNESS_BALANCED,
 	STRICTNESS_TOLERANT,
@@ -174,6 +180,11 @@ const ERR_SPLIT_ZIP_FILE = "Split zip file";
 const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
 const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 const ERR_ENCRYPTED_CENTRAL_DIRECTORY = "Encrypted central directory is not supported";
+const ERR_UNSAFE_FILENAME = "Unsafe filename";
+const ERR_INVALID_STRICTNESS = "Invalid strictness (must be 'strict', 'balanced' or 'tolerant')";
+const ERR_INVALID_FILENAME_VALIDATION = "Invalid filenameValidation (must be 'strict', 'balanced' or 'tolerant')";
+const ERR_INVALID_MAX_APPENDED_DATA_SIZE = "Invalid maxAppendedDataSize (must be a number greater than or equal to 0)";
+const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
 const CHARSET_UTF8 = "utf-8";
 const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 const CHARSET_CP437 = "cp437";
@@ -195,6 +206,10 @@ const ZIP64_EXTRACTION = {
 		bytes: 8
 	}
 };
+const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+const CENTRAL_DIRECTORY_UNREACHABLE = 0;
+const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
+const CENTRAL_DIRECTORY_REACHABLE = 2;
 
 class ZipReader {
 
@@ -223,6 +238,8 @@ class ZipReader {
 		const checkAmbiguity = strictness == STRICTNESS_STRICT;
 		const rejectAmbiguousEndOfDirectory = strictness != STRICTNESS_TOLERANT;
 		const maxAppendedDataSize = getMaxAppendedDataSize(getOptionValue(zipReader, options, OPTION_MAX_APPENDED_DATA_SIZE), strictness);
+		const filenameValidation = getFilenameValidation(getOptionValue(zipReader, options, OPTION_FILENAME_VALIDATION), strictness);
+		const normalizeFilename = getOptionValue(zipReader, options, OPTION_NORMALIZE_FILENAME);
 		const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 		if (!endOfDirectoryInfo) {
 			const signatureArray = await readUint8Array(reader, 0, 4);
@@ -416,11 +433,22 @@ class ZipReader {
 			const decode = getOptionValue(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 			const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 			const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
-			let filename = decode(rawFilename, rawFilenameEncoding);
+			let filename = decode(rawFilename, rawFilenameEncoding, TEXT_TYPE_FILENAME);
 			if (filename === UNDEFINED_VALUE) {
 				filename = decodeText(rawFilename, rawFilenameEncoding);
 			}
-			let comment = decode(rawComment, rawCommentEncoding);
+			if (normalizeFilename) {
+				const normalizedFilename = normalizeFilename(filename);
+				if (normalizedFilename !== UNDEFINED_VALUE) {
+					filename = normalizedFilename;
+				}
+			}
+			if (isUnsafeFilename(filename, filenameValidation)) {
+				const error = new Error(ERR_UNSAFE_FILENAME);
+				error.filename = filename;
+				throw error;
+			}
+			let comment = decode(rawComment, rawCommentEncoding, TEXT_TYPE_COMMENT);
 			if (comment === UNDEFINED_VALUE) {
 				comment = decodeText(rawComment, rawCommentEncoding);
 			}
@@ -481,10 +509,10 @@ class ZipReader {
 			entry.getData = (writer, options) => fileEntry.getData(writer, entry, zipReader.readRanges, options);
 			entry.arrayBuffer = async options => {
 				const writer = new TransformStream();
-				const [arrayBuffer] = await Promise.all([
-					streamToBlob(writer.readable).then(blob => blob.arrayBuffer()),
-					fileEntry.getData(writer, entry, zipReader.readRanges, options)]);
-				return arrayBuffer;
+				const arrayBufferPromise = streamToBlob(writer.readable).then(blob => blob.arrayBuffer());
+				arrayBufferPromise.catch(() => { });
+				await fileEntry.getData(writer, entry, zipReader.readRanges, options);
+				return arrayBufferPromise;
 			};
 			offset = endOffset;
 			const { onprogress } = options;
@@ -600,6 +628,10 @@ export {
 	ERR_OVERLAPPING_ENTRY,
 	ERR_AMBIGUOUS_ARCHIVE,
 	ERR_ENCRYPTED_CENTRAL_DIRECTORY,
+	ERR_UNSAFE_FILENAME,
+	ERR_INVALID_STRICTNESS,
+	ERR_INVALID_FILENAME_VALIDATION,
+	ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 	ERR_WORKER_STARTUP_TIMEOUT
 };
 
@@ -760,7 +792,7 @@ class ZipEntry {
 				readRanges
 			});
 		}
-		let writable;
+		let writable, abortError;
 		try {
 			if (!checkOverlappingEntryOnly) {
 				if (checkPasswordOnly) {
@@ -780,12 +812,22 @@ class ZipEntry {
 				writer.size += error.outputSize;
 			}
 			if (!checkPasswordOnly || error.message != ERR_ABORT_CHECK_PASSWORD) {
+				abortError = error;
 				throw error;
 			}
 		} finally {
 			const preventClose = getOptionValue(zipEntry, options, OPTION_PREVENT_CLOSE);
 			if (!preventClose && writable && !writable.locked) {
-				await writable.getWriter().close();
+				const writableWriter = writable.getWriter();
+				if (abortError) {
+					try {
+						await writableWriter.abort(abortError);
+					} catch {
+						// the error being propagated is more relevant; ignored
+					}
+				} else {
+					await writableWriter.close();
+				}
 			}
 		}
 		return checkPasswordOnly || checkOverlappingEntryOnly ? UNDEFINED_VALUE : writer.getData ? writer.getData() : writable;
@@ -1165,16 +1207,51 @@ function getDiskOffset(reader, diskNumber) {
 	return reader.getDiskOffset ? reader.getDiskOffset(diskNumber) : 0;
 }
 
+function isStrictnessValue(value) {
+	return value === STRICTNESS_STRICT || value === STRICTNESS_BALANCED || value === STRICTNESS_TOLERANT;
+}
+
 function getStrictness(strictness, checkAmbiguity) {
 	if (strictness === UNDEFINED_VALUE) {
 		return checkAmbiguity ? STRICTNESS_STRICT : STRICTNESS_BALANCED;
 	}
+	if (!isStrictnessValue(strictness)) {
+		throw new Error(ERR_INVALID_STRICTNESS);
+	}
 	return strictness;
 }
 
+function getFilenameValidation(filenameValidation, strictness) {
+	if (filenameValidation === UNDEFINED_VALUE) {
+		return strictness;
+	}
+	if (!isStrictnessValue(filenameValidation)) {
+		throw new Error(ERR_INVALID_FILENAME_VALIDATION);
+	}
+	return filenameValidation;
+}
+
+function isUnsafeFilename(filename, filenameValidation) {
+	if (filenameValidation == STRICTNESS_TOLERANT) {
+		return false;
+	}
+	const pathParts = filename.split("/");
+	if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
+		pathParts.pop();
+	}
+	if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+		return true;
+	}
+	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+}
+
 function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 	if (maxAppendedDataSize !== UNDEFINED_VALUE) {
-		return maxAppendedDataSize;
+		const size = toNumber(maxAppendedDataSize);
+		if (typeof size != NUMBER_TYPE || Number.isNaN(size) || size < 0) {
+			throw new Error(ERR_INVALID_MAX_APPENDED_DATA_SIZE);
+		}
+		return size;
 	}
 	if (strictness == STRICTNESS_STRICT) {
 		return 0;
@@ -1185,12 +1262,6 @@ function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 	return MAX_16_BITS;
 }
 
-const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
-
-const CENTRAL_DIRECTORY_UNREACHABLE = 0;
-const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
-const CENTRAL_DIRECTORY_REACHABLE = 2;
-
 async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 	const { size } = reader;
 	const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
@@ -1326,6 +1397,10 @@ function getOptionValue(zipReader, options, name) {
 	return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 }
 
+function toNumber(value) {
+	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+}
+
 function getDate(timeRaw) {
 	const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
 	return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
@@ -1350,4 +1425,3 @@ function getUint32(view, offset) {
 function getBigUint64(view, offset) {
 	return Number(view.getBigUint64(offset, true));
 }
-

package/lib/core/zip-writer.js

@@ -140,6 +140,7 @@ import {
 	UNDEFINED_VALUE,
 	INFINITY_VALUE,
 	OBJECT_TYPE,
+	STRING_TYPE,
 	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
@@ -212,7 +213,9 @@ import {
 	OPTION_USDZ,
 	OPTION_UNIX_EXTRA_FIELD_TYPE,
 	OPTION_LOCAL_EXTRA_FIELD,
-	OPTION_SIGN_CENTRAL_DIRECTORY
+	OPTION_SIGN_CENTRAL_DIRECTORY,
+	TEXT_TYPE_FILENAME,
+	TEXT_TYPE_COMMENT
 } from "./options.js";
 
 const ERR_DUPLICATED_NAME = "File already exists";
@@ -240,6 +243,8 @@ const ERR_INVALID_UNIX_EXTRA_FIELD_TYPE = "Invalid unixExtraFieldType (must be '
 const ERR_INVALID_UNIX_ID_SIZE = "uid/gid must be 0..65535 for unixExtraFieldType 'unix' (use 'infozip' for larger ids)";
 const ERR_INVALID_MSDOS_ATTRIBUTES = "Invalid msdosAttributesRaw (must be integer 0..255)";
 const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
+const ERR_INVALID_LEVEL = "Invalid level (must be integer 0..9)";
+const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 const ERR_INVALID_SIGNATURE_DATA = "Signature data exceeds 64KB";
 
 const EXTRAFIELD_DATA_AES = new Uint8Array([0x07, 0x00, 0x02, 0x00, 0x41, 0x45, 0x03, 0x00, 0x00]);
@@ -247,6 +252,7 @@ const EXTRAFIELD_OFFSET_AES_VENDOR_VERSION = 4;
 const VENDOR_VERSION_AE_1 = 1;
 const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 const UNIX_EXTRA_FIELD_TYPE = "unix";
+const MAX_LEVEL = 9;
 
 let workers = 0;
 const pendingEntries = [];
@@ -409,7 +415,8 @@ class ZipWriter {
 
 	remove(entry) {
 		const { filenames, files } = this;
-		if (typeof entry == "string") {
+		// deno-lint-ignore valid-typeof
+		if (typeof entry == STRING_TYPE) {
 			entry = files.get(entry);
 		}
 		if (entry && entry.filename !== UNDEFINED_VALUE) {
@@ -528,6 +535,8 @@ export {
 	ERR_INVALID_UNIX_ID_SIZE,
 	ERR_INVALID_MSDOS_ATTRIBUTES,
 	ERR_INVALID_MSDOS_DATA,
+	ERR_INVALID_LEVEL,
+	ERR_INVALID_PASSWORD_TYPE,
 	ERR_UNSUPPORTED_CRYPTO_API
 };
 
@@ -574,20 +583,20 @@ function resolveAttributes(zipWriter, name, options) {
 	let msDosCompatible = getOptionValue(zipWriter, options, PROPERTY_NAME_MS_DOS_COMPATIBLE);
 	let versionMadeBy = getOptionValue(zipWriter, options, PROPERTY_NAME_VERSION_MADE_BY, msDosCompatible ? 20 : 768);
 	const executable = getOptionValue(zipWriter, options, PROPERTY_NAME_EXECUTABLE);
-	const uid = getOptionValue(zipWriter, options, PROPERTY_NAME_UID);
-	const gid = getOptionValue(zipWriter, options, PROPERTY_NAME_GID);
-	let unixMode = getOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
+	const uid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UID);
+	const gid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_GID);
+	let unixMode = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
 	let unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
 	let setuid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETUID);
 	let setgid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETGID);
 	let sticky = getOptionValue(zipWriter, options, PROPERTY_NAME_STICKY);
-	if (uid !== UNDEFINED_VALUE && (uid < 0 || uid > MAX_32_BITS)) {
+	if (uid !== UNDEFINED_VALUE && (!Number.isInteger(uid) || uid < 0 || uid > MAX_32_BITS)) {
 		throw new Error(ERR_INVALID_UID);
 	}
-	if (gid !== UNDEFINED_VALUE && (gid < 0 || gid > MAX_32_BITS)) {
+	if (gid !== UNDEFINED_VALUE && (!Number.isInteger(gid) || gid < 0 || gid > MAX_32_BITS)) {
 		throw new Error(ERR_INVALID_GID);
 	}
-	if (unixMode !== UNDEFINED_VALUE && (unixMode < 0 || unixMode > MAX_16_BITS)) {
+	if (unixMode !== UNDEFINED_VALUE && (!Number.isInteger(unixMode) || unixMode < 0 || unixMode > MAX_16_BITS)) {
 		throw new Error(ERR_INVALID_UNIX_MODE);
 	}
 	if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
@@ -699,7 +708,7 @@ function resolveAttributes(zipWriter, name, options) {
 
 function resolveMetadata(zipWriter, name, options) {
 	const encode = getOptionValue(zipWriter, options, OPTION_ENCODE_TEXT, encodeText);
-	let rawFilename = encode(name);
+	let rawFilename = encode(name, TEXT_TYPE_FILENAME);
 	if (rawFilename === UNDEFINED_VALUE) {
 		rawFilename = encodeText(name);
 	}
@@ -707,7 +716,7 @@ function resolveMetadata(zipWriter, name, options) {
 		throw new Error(ERR_INVALID_ENTRY_NAME);
 	}
 	const comment = options[PROPERTY_NAME_COMMENT] || "";
-	let rawComment = encode(comment);
+	let rawComment = encode(comment, TEXT_TYPE_COMMENT);
 	if (rawComment === UNDEFINED_VALUE) {
 		rawComment = encodeText(comment);
 	}
@@ -727,8 +736,11 @@ function resolveMetadata(zipWriter, name, options) {
 	if (!passThrough) {
 		password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
 		rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+		if ((password && typeof password != STRING_TYPE) || (rawPassword && !(rawPassword instanceof Uint8Array))) {
+			throw new Error(ERR_INVALID_PASSWORD_TYPE);
+		}
 	}
-	const encryptionStrength = getOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
+	const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 	const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 	const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
 	const ntfsTimestamp = getOptionValue(zipWriter, options, OPTION_NTFS_TIMESTAMP);
@@ -746,7 +758,10 @@ function resolveMetadata(zipWriter, name, options) {
 		compressionMethod !== COMPRESSION_METHOD_STORE && compressionMethod !== COMPRESSION_METHOD_DEFLATE && !registeredCodec) {
 		throw new Error(ERR_UNSUPPORTED_COMPRESSION);
 	}
-	let level = getOptionValue(zipWriter, options, OPTION_LEVEL);
+	let level = getNumberOptionValue(zipWriter, options, OPTION_LEVEL);
+	if (level !== UNDEFINED_VALUE && (!Number.isInteger(level) || level < 0 || level > MAX_LEVEL)) {
+		throw new Error(ERR_INVALID_LEVEL);
+	}
 	if (zipWriter.options[OPTION_USDZ]) {
 		if (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) {
 			throw new Error(ERR_UNSUPPORTED_ENCRYPTION_USDZ);
@@ -767,7 +782,7 @@ function resolveMetadata(zipWriter, name, options) {
 		useCompressionStream = false;
 	}
 	const zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
-	if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
+	if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(Number.isInteger(encryptionStrength) && encryptionStrength >= 1 && encryptionStrength <= 3)) {
 		throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 	}
 	const rawExtraField = serializeExtraField(options[PROPERTY_NAME_EXTRA_FIELD]);
@@ -1961,6 +1976,14 @@ function getOptionValue(zipWriter, options, name, defaultValue) {
 	return result === UNDEFINED_VALUE ? defaultValue : result;
 }
 
+function getNumberOptionValue(zipWriter, options, name, defaultValue) {
+	return toNumber(getOptionValue(zipWriter, options, name, defaultValue));
+}
+
+function toNumber(value) {
+	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+}
+
 function getMaximumCompressedSize(uncompressedSize) {
 	return uncompressedSize + (5 * (Math.floor(uncompressedSize / 16383) + 1));
 }

package/lib/zip-core-reader.js

@@ -26,6 +26,8 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+import "./core/codec-worker-web.js";
+
 export {
 	ZipReader,
 	ZipReaderStream,
@@ -48,5 +50,9 @@ export {
 	ERR_OVERLAPPING_ENTRY,
 	ERR_AMBIGUOUS_ARCHIVE,
 	ERR_ENCRYPTED_CENTRAL_DIRECTORY,
+	ERR_UNSAFE_FILENAME,
+	ERR_INVALID_STRICTNESS,
+	ERR_INVALID_FILENAME_VALIDATION,
+	ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 	ERR_WORKER_STARTUP_TIMEOUT
 } from "./core/zip-reader.js";

package/lib/zip-core-writer.js

@@ -26,6 +26,8 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+import "./core/codec-worker-web.js";
+
 export {
 	ZipWriter,
 	ZipWriterStream,
@@ -50,5 +52,7 @@ export {
 	ERR_INVALID_UNIX_ID_SIZE,
 	ERR_INVALID_MSDOS_ATTRIBUTES,
 	ERR_INVALID_MSDOS_DATA,
+	ERR_INVALID_LEVEL,
+	ERR_INVALID_PASSWORD_TYPE,
 	ERR_UNSUPPORTED_CRYPTO_API
 } from "./core/zip-writer.js";

package/package.json

@@ -3,7 +3,7 @@
   "description": "A JavaScript library to zip and unzip files in the browser, Deno and Node.js",
   "author": "Gildas Lormeau",
   "license": "BSD-3-Clause",
-  "version": "2.8.49",
+  "version": "2.8.50",
   "type": "module",
   "keywords": [
     "zip",