compressing 2.0.0 → 2.1.0

package/README.md

@@ -169,7 +169,7 @@ const urllib = require('urllib');
 const targetDir = require('os').tmpdir();
 const compressing = require('compressing');
 
-urllib.request('http://registry.npmjs.org/pedding/-/pedding-1.1.0.tgz', {
+urllib.request('http://registry.npmjs.org/compressing/-/compressing-2.0.0.tgz', {
   streaming: true,
   followRedirect: true,
 })
@@ -280,6 +280,7 @@ Params
     - Korean: cp949, euc-kr
     - Japanese: sjis (shift_jis), cp932, euc-jp
     - Chinese: gbk, gb18030, gb2312, cp936, hkscs, big5, cp950
+  - opts.strip {Number} - Strip leading path segments when extracting (tar/tgz/zip). Default is 0.
 
 ### FileStream
 
@@ -359,6 +360,7 @@ __Constructor__
 Common params:
 
 - opts.source {String|Buffer|Stream} - source to be uncompressed, could be a file path, buffer, or a readable stream.
+- opts.strip {Number} - Strip leading path segments when extracting (tar/tgz/zip). Default is 0.
 
 __CAUTION for zip.UncompressStream__
 

package/lib/utils.js

@@ -4,6 +4,22 @@ const fs = require('fs');
 const path = require('path');
 const { pipeline: pump } = require('stream');
 
+/**
+ * Check if childPath is within parentPath (prevents path traversal attacks)
+ * @param {string} childPath - The path to check
+ * @param {string} parentPath - The parent directory path
+ * @returns {boolean} - True if childPath is within parentPath
+ */
+function isPathWithinParent(childPath, parentPath) {
+  const normalizedChild = path.resolve(childPath);
+  const normalizedParent = path.resolve(parentPath);
+  const parentWithSep = normalizedParent.endsWith(path.sep)
+    ? normalizedParent
+    : normalizedParent + path.sep;
+  return normalizedChild === normalizedParent ||
+         normalizedChild.startsWith(parentWithSep);
+}
+
 // file/fileBuffer/stream
 exports.sourceType = source => {
   if (!source) return undefined;
@@ -88,10 +104,17 @@ exports.makeUncompressFn = StreamClass => {
       throw error;
     }
 
+    const strip = opts.strip ? Number(opts.strip) : 0;
+    // Strip is handled here in makeUncompressFn, so remove it from opts to avoid passing to UncompressStream
+    delete opts.strip;
+
     return new Promise((resolve, reject) => {
       fs.mkdir(destDir, { recursive: true }, err => {
         if (err) return reject(err);
 
+        // Resolve destDir to absolute path for security validation
+        const resolvedDestDir = path.resolve(destDir);
+
         let entryCount = 0;
         let successCount = 0;
         let isFinish = false;
@@ -108,7 +131,15 @@ exports.makeUncompressFn = StreamClass => {
           .on('error', reject)
           .on('entry', (header, stream, next) => {
             stream.on('end', next);
-            const destFilePath = path.join(destDir, header.name);
+            const destFilePath = path.join(resolvedDestDir, stripFileName(strip, header.name, header.type));
+            const resolvedDestPath = path.resolve(destFilePath);
+
+            // Security: Validate that the entry path doesn't escape the destination directory
+            if (!isPathWithinParent(resolvedDestPath, resolvedDestDir)) {
+              console.warn(`[compressing] Skipping entry with path traversal: "${header.name}" -> "${resolvedDestPath}"`);
+              stream.resume();
+              return;
+            }
 
             if (header.type === 'file') {
               const dir = path.dirname(destFilePath);
@@ -125,6 +156,14 @@ exports.makeUncompressFn = StreamClass => {
             } else if (header.type === 'symlink') {
               const dir = path.dirname(destFilePath);
               const target = path.resolve(dir, header.linkname);
+
+              // Security: Validate that the symlink target doesn't escape the destination directory
+              if (!isPathWithinParent(target, resolvedDestDir)) {
+                console.warn(`[compressing] Skipping symlink "${header.name}": target "${target}" escapes extraction directory`);
+                stream.resume();
+                return;
+              }
+
               entryCount++;
 
               fs.mkdir(dir, { recursive: true }, err => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "compressing",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Everything you need for compressing and uncompressing",
   "main": "index.js",
   "scripts": {