compressing 2.0.0 → 2.0.1

package/README.md

@@ -169,7 +169,7 @@ const urllib = require('urllib');
 const targetDir = require('os').tmpdir();
 const compressing = require('compressing');
 
-urllib.request('http://registry.npmjs.org/pedding/-/pedding-1.1.0.tgz', {
+urllib.request('http://registry.npmjs.org/compressing/-/compressing-2.0.0.tgz', {
   streaming: true,
   followRedirect: true,
 })

package/lib/utils.js

@@ -4,6 +4,22 @@ const fs = require('fs');
 const path = require('path');
 const { pipeline: pump } = require('stream');
 
+/**
+ * Check if childPath is within parentPath (prevents path traversal attacks)
+ * @param {string} childPath - The path to check
+ * @param {string} parentPath - The parent directory path
+ * @returns {boolean} - True if childPath is within parentPath
+ */
+function isPathWithinParent(childPath, parentPath) {
+  const normalizedChild = path.resolve(childPath);
+  const normalizedParent = path.resolve(parentPath);
+  const parentWithSep = normalizedParent.endsWith(path.sep)
+    ? normalizedParent
+    : normalizedParent + path.sep;
+  return normalizedChild === normalizedParent ||
+         normalizedChild.startsWith(parentWithSep);
+}
+
 // file/fileBuffer/stream
 exports.sourceType = source => {
   if (!source) return undefined;
@@ -92,6 +108,9 @@ exports.makeUncompressFn = StreamClass => {
       fs.mkdir(destDir, { recursive: true }, err => {
         if (err) return reject(err);
 
+        // Resolve destDir to absolute path for security validation
+        const resolvedDestDir = path.resolve(destDir);
+
         let entryCount = 0;
         let successCount = 0;
         let isFinish = false;
@@ -108,7 +127,15 @@ exports.makeUncompressFn = StreamClass => {
           .on('error', reject)
           .on('entry', (header, stream, next) => {
             stream.on('end', next);
-            const destFilePath = path.join(destDir, header.name);
+            const destFilePath = path.join(resolvedDestDir, header.name);
+            const resolvedDestPath = path.resolve(destFilePath);
+
+            // Security: Validate that the entry path doesn't escape the destination directory
+            if (!isPathWithinParent(resolvedDestPath, resolvedDestDir)) {
+              console.warn(`[compressing] Skipping entry with path traversal: "${header.name}" -> "${resolvedDestPath}"`);
+              stream.resume();
+              return;
+            }
 
             if (header.type === 'file') {
               const dir = path.dirname(destFilePath);
@@ -125,6 +152,14 @@ exports.makeUncompressFn = StreamClass => {
             } else if (header.type === 'symlink') {
               const dir = path.dirname(destFilePath);
               const target = path.resolve(dir, header.linkname);
+
+              // Security: Validate that the symlink target doesn't escape the destination directory
+              if (!isPathWithinParent(target, resolvedDestDir)) {
+                console.warn(`[compressing] Skipping symlink "${header.name}": target "${target}" escapes extraction directory`);
+                stream.resume();
+                return;
+              }
+
               entryCount++;
 
               fs.mkdir(dir, { recursive: true }, err => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "compressing",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Everything you need for compressing and uncompressing",
   "main": "index.js",
   "scripts": {