@zklogic/unzipper 0.13.0 → 0.13.1

package/README.md

@@ -60,7 +60,7 @@ async function main() {
       .stream()
       .pipe(fs.createWriteStream('firstFile'))
       .on('error',reject)
-      .on('finish',resolve)
+      .on('close',resolve)
   });
 }
 
@@ -139,7 +139,7 @@ async function main() {
       .stream()
       .pipe(fs.createWriteStream('firstFile'))
       .on('error',reject)
-      .on('finish',resolve)
+      .on('close',resolve)
   });
 }
 
@@ -309,7 +309,7 @@ fs.createReadStream('path/to/archive.zip')
       const size = entry.vars.uncompressedSize; // There is also compressedSize;
       if (fileName === "this IS the file I'm looking for") {
         entry.pipe(fs.createWriteStream('output/path'))
-          .on('finish',cb);
+          .on('close',cb);
       } else {
         entry.autodrain();
         cb();

package/lib/Open/directory.js

@@ -157,8 +157,9 @@ module.exports = function centralDirectory(source, options) {
             // to avoid zip slip (writing outside of the destination), we resolve
             // the target path, and make sure it's nested in the intended
             // destination, or not extract it otherwise.
-            const extractPath = path.join(opts.path, entry.path);
-            if (extractPath.indexOf(opts.path) != 0) {
+            const extractPath = path.join(opts.path, entry.path.replace(/\\/g, '/'));
+            const rel = path.relative(opts.path, extractPath);
+            if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {
               return;
             }
 

package/lib/extract.js

@@ -21,7 +21,8 @@ function Extract (opts) {
     // NOTE: Need to normalize to forward slashes for UNIX OS's to properly
     // ignore the zip slipped file entirely
     const extractPath = path.join(opts.path, entry.path.replace(/\\/g, '/'));
-    if (extractPath.indexOf(opts.path) != 0) {
+    const rel = path.relative(opts.path, extractPath);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {
       return cb();
     }
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@zklogic/unzipper",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Unzip cross-platform streaming API ",
   "author": {
-    "email": "arfankhalil@hotmail.com",
     "name": "Arfan Khalil Mughal",
+    "email": "arfankhalil@hotmail.com",
     "url": "https://github.com/ArfanKhalilMughal"
   },
   "contributors": [
@@ -25,12 +25,25 @@
     "type": "git",
     "url": "https://github.com/ArfanKhalilMughal/node-unzipper.git"
   },
+  "forkedFrom": {
+    "repository": "https://github.com/ZJONSSON/node-unzipper",
+    "author": "Ziggy Jonsson",
+    "url": "https://github.com/ZJONSSON"
+  },
+  "bugs": {
+    "email": "arfankhalil@hotmail.com",
+    "url": "https://github.com/ArfanKhalilMughal/node-unzipper/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "license": "MIT",
   "dependencies": {
     "bluebird": "~3.7.2",
     "duplexer2": "~0.1.4",
-    "fs-extra": "^11.2.0",
-    "graceful-fs": "^4.2.2"
+    "fs-extra": "11.3.1",
+    "graceful-fs": "^4.2.2",
+    "node-int64": "^0.4.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.2.0",