extract-base-iterator 3.4.2 → 3.4.3

package/dist/cjs/DirectoryEntry.js

@@ -15,6 +15,7 @@ var _chmodts = /*#__PURE__*/ _interop_require_default(require("./fs/chmod.js"));
 var _chownts = /*#__PURE__*/ _interop_require_default(require("./fs/chown.js"));
 var _utimests = /*#__PURE__*/ _interop_require_default(require("./fs/utimes.js"));
 var _indexts = require("./shared/index.js");
+var _safeJoinPathts = /*#__PURE__*/ _interop_require_default(require("./shared/safeJoinPath.js"));
 var _stripPathts = /*#__PURE__*/ _interop_require_default(require("./shared/stripPath.js"));
 var _validateAttributests = /*#__PURE__*/ _interop_require_default(require("./validateAttributes.js"));
 var _waitForAccessts = /*#__PURE__*/ _interop_require_default(require("./waitForAccess.js"));
@@ -50,7 +51,7 @@ var DirectoryEntry = /*#__PURE__*/ function() {
         if (typeof callback === 'function') {
             try {
                 var normalizedPath = _path.default.normalize(this.path);
-                var fullPath = _path.default.join(dest, (0, _stripPathts.default)(normalizedPath, options));
+                var fullPath = (0, _safeJoinPathts.default)(dest, (0, _stripPathts.default)(normalizedPath, options));
                 // do not check for the existence of the directory but allow out-of-order calling
                 var queue = new _queuecb.default(1);
                 queue.defer(_mkdirpclassic.default.bind(null, fullPath));

package/dist/cjs/DirectoryEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/DirectoryEntry.ts"],"sourcesContent":["import mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { DirectoryAttributes, ExtractOptions, NoParamCallback } from './types.ts';\n\nexport default class DirectoryEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: DirectoryAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.type === undefined) this.type = 'directory';\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n\n        // do not check for the existence of the directory but allow out-of-order calling\n        const queue = new Queue(1);\n        queue.defer(mkdirp.bind(null, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["DirectoryEntry","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","type","undefined","basename","path","create","dest","options","callback","normalizedPath","normalize","fullPath","join","stripPath","queue","Queue","defer","mkdirp","bind","waitForAccess","chmod","chown","utimes","await","err","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAgBqBA;;;oEAhBF;2DACF;8DACC;8DACA;8DACA;+DACC;uBACU;kEACP;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AAKvC,IAAA,AAAMD,+BAAN;;aAAMA,eAOPE,UAA+B;gCAPxBF;QAQjBG,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,IAAI,KAAKC,WAAW,IAAI,CAACD,IAAI,GAAG;QACzC,IAAI,IAAI,CAACE,QAAQ,KAAKD,WAAW,IAAI,CAACC,QAAQ,GAAGC,aAAI,CAACD,QAAQ,CAAC,IAAI,CAACC,IAAI;;iBAXvDR;IAiBnBS,OAAAA,MAwBC,GAxBDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBL,aAAI,CAACM,SAAS,CAAC,IAAI,CAACN,IAAI;gBAC/C,IAAMO,WAAWP,aAAI,CAACQ,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAE3D,iFAAiF;gBACjF,IAAMO,QAAQ,IAAIC,gBAAK,CAAC;gBACxBD,MAAME,KAAK,CAACC,sBAAM,CAACC,IAAI,CAAC,MAAMP;gBAC9BG,MAAME,KAAK,CAACG,wBAAa,CAACD,IAAI,CAAC,MAAMP;gBACrCG,MAAME,KAAK,CAACI,gBAAK,CAACF,IAAI,CAAC,MAAMP,UAAU,IAAI,EAAEJ;gBAC7CO,MAAME,KAAK,CAACK,gBAAK,CAACH,IAAI,CAAC,MAAMP,UAAU,IAAI,EAAEJ;gBAC7CO,MAAME,KAAK,CAACM,iBAAM,CAACJ,IAAI,CAAC,MAAMP,UAAU,IAAI,EAAEJ;gBAC9CO,MAAMS,KAAK,CAACf;YACd,EAAE,OAAOgB,KAAK;gBACZhB,SAASgB;YACX;YACA;QACF;QAEA,OAAO,IAAIC,QAAQ,SAACC,SAASC;mBAAW,MAAKtB,MAAM,CAACC,MAAMC,SAAS,SAACiB,KAAaI;uBAAoBJ,MAAMG,OAAOH,OAAOE,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WA3CQjC"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/DirectoryEntry.ts"],"sourcesContent":["import mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { DirectoryAttributes, ExtractOptions, NoParamCallback } from './types.ts';\n\nexport default class DirectoryEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: DirectoryAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.type === undefined) this.type = 'directory';\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n\n        // do not check for the existence of the directory but allow out-of-order calling\n        const queue = new Queue(1);\n        queue.defer(mkdirp.bind(null, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["DirectoryEntry","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","type","undefined","basename","path","create","dest","options","callback","normalizedPath","normalize","fullPath","safeJoinPath","stripPath","queue","Queue","defer","mkdirp","bind","waitForAccess","chmod","chown","utimes","await","err","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAiBqBA;;;oEAjBF;2DACF;8DACC;8DACA;8DACA;+DACC;uBACU;qEACJ;kEACH;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AAKvC,IAAA,AAAMD,+BAAN;;aAAMA,eAOPE,UAA+B;gCAPxBF;QAQjBG,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,IAAI,KAAKC,WAAW,IAAI,CAACD,IAAI,GAAG;QACzC,IAAI,IAAI,CAACE,QAAQ,KAAKD,WAAW,IAAI,CAACC,QAAQ,GAAGC,aAAI,CAACD,QAAQ,CAAC,IAAI,CAACC,IAAI;;iBAXvDR;IAiBnBS,OAAAA,MAwBC,GAxBDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBL,aAAI,CAACM,SAAS,CAAC,IAAI,CAACN,IAAI;gBAC/C,IAAMO,WAAWC,IAAAA,uBAAY,EAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAE9D,iFAAiF;gBACjF,IAAMO,QAAQ,IAAIC,gBAAK,CAAC;gBACxBD,MAAME,KAAK,CAACC,sBAAM,CAACC,IAAI,CAAC,MAAMP;gBAC9BG,MAAME,KAAK,CAACG,wBAAa,CAACD,IAAI,CAAC,MAAMP;gBACrCG,MAAME,KAAK,CAACI,gBAAK,CAACF,IAAI,CAAC,MAAMP,UAAU,IAAI,EAAEJ;gBAC7CO,MAAME,KAAK,CAACK,gBAAK,CAACH,IAAI,CAAC,MAAMP,UAAU,IAAI,EAAEJ;gBAC7CO,MAAME,KAAK,CAACM,iBAAM,CAACJ,IAAI,CAAC,MAAMP,UAAU,IAAI,EAAEJ;gBAC9CO,MAAMS,KAAK,CAACf;YACd,EAAE,OAAOgB,KAAK;gBACZhB,SAASgB;YACX;YACA;QACF;QAEA,OAAO,IAAIC,QAAQ,SAACC,SAASC;mBAAW,MAAKtB,MAAM,CAACC,MAAMC,SAAS,SAACiB,KAAaI;uBAAoBJ,MAAMG,OAAOH,OAAOE,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WA3CQjC"}

package/dist/cjs/FileEntry.js

@@ -17,6 +17,7 @@ var _chmodts = /*#__PURE__*/ _interop_require_default(require("./fs/chmod.js"));
 var _chownts = /*#__PURE__*/ _interop_require_default(require("./fs/chown.js"));
 var _utimests = /*#__PURE__*/ _interop_require_default(require("./fs/utimes.js"));
 var _indexts = require("./shared/index.js");
+var _safeJoinPathts = /*#__PURE__*/ _interop_require_default(require("./shared/safeJoinPath.js"));
 var _stripPathts = /*#__PURE__*/ _interop_require_default(require("./shared/stripPath.js"));
 var _validateAttributests = /*#__PURE__*/ _interop_require_default(require("./validateAttributes.js"));
 var _waitForAccessts = /*#__PURE__*/ _interop_require_default(require("./waitForAccess.js"));
@@ -53,7 +54,7 @@ var FileEntry = /*#__PURE__*/ function() {
         if (typeof callback === 'function') {
             try {
                 var normalizedPath = _path.default.normalize(this.path);
-                var fullPath = _path.default.join(dest, (0, _stripPathts.default)(normalizedPath, options));
+                var fullPath = (0, _safeJoinPathts.default)(dest, (0, _stripPathts.default)(normalizedPath, options));
                 var queue = new _queuecb.default(1);
                 if (options.force) {
                     queue.defer(function(callback) {

package/dist/cjs/FileEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/FileEntry.ts"],"sourcesContent":["import { rm } from 'fs-remove-compat';\nimport fs from 'graceful-fs';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, FileAttributes, NoParamCallback, WriteFileFn } from './types.ts';\n\ninterface AbstractFileEntry {\n  _writeFile: WriteFileFn;\n}\n\nexport default class FileEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: FileAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'file';\n    if ((this as unknown as AbstractFileEntry)._writeFile === undefined) throw new Error('File this missing _writeFile. Please implement this method in your subclass');\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        } else {\n          // Check if file exists - throw EEXIST if it does\n          queue.defer((callback) => {\n            fs.stat(fullPath, (err) => {\n              if (!err) {\n                const existsErr = new Error(`EEXIST: file already exists, open '${fullPath}'`) as NodeJS.ErrnoException;\n                existsErr.code = 'EEXIST';\n                existsErr.path = fullPath;\n                return callback(existsErr);\n              }\n              // ENOENT means file doesn't exist - that's what we want\n              if (err.code === 'ENOENT') return callback();\n              // Other errors should be reported\n              callback(err);\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer((this as unknown as AbstractFileEntry)._writeFile.bind(this, fullPath, options));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["FileEntry","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","basename","undefined","path","type","_writeFile","Error","create","dest","options","callback","normalizedPath","normalize","fullPath","join","stripPath","queue","Queue","force","defer","rm","err","code","fs","stat","existsErr","mkdirp","bind","dirname","waitForAccess","chmod","chown","utimes","await","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAsBqBA;;;8BAtBF;iEACJ;oEACI;2DACF;8DACC;8DACA;8DACA;+DACC;uBACU;kEACP;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AASvC,IAAA,AAAMD,0BAAN;;aAAMA,UAOPE,UAA0B;gCAPnBF;QAQjBG,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGE,aAAI,CAACF,QAAQ,CAAC,IAAI,CAACE,IAAI;QACxE,IAAI,IAAI,CAACC,IAAI,KAAKF,WAAW,IAAI,CAACE,IAAI,GAAG;QACzC,IAAI,AAAC,IAAI,CAAkCC,UAAU,KAAKH,WAAW,MAAM,IAAII,MAAM;;iBAZpEV;IAkBnBW,OAAAA,MA+CC,GA/CDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBR,aAAI,CAACS,SAAS,CAAC,IAAI,CAACT,IAAI;gBAC/C,IAAMU,WAAWV,aAAI,CAACW,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAE3D,IAAMO,QAAQ,IAAIC,gBAAK,CAAC;gBACxB,IAAIR,QAAQS,KAAK,EAAE;oBACjBF,MAAMG,KAAK,CAAC,SAACT;wBACXU,IAAAA,kBAAE,EAACP,UAAU,SAACQ;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWZ,SAASW,OAAOX;wBACjD;oBACF;gBACF,OAAO;oBACL,iDAAiD;oBACjDM,MAAMG,KAAK,CAAC,SAACT;wBACXa,mBAAE,CAACC,IAAI,CAACX,UAAU,SAACQ;4BACjB,IAAI,CAACA,KAAK;gCACR,IAAMI,YAAY,IAAInB,MAAM,AAAC,sCAA8C,OAATO,UAAS;gCAC3EY,UAAUH,IAAI,GAAG;gCACjBG,UAAUtB,IAAI,GAAGU;gCACjB,OAAOH,SAASe;4BAClB;4BACA,wDAAwD;4BACxD,IAAIJ,IAAIC,IAAI,KAAK,UAAU,OAAOZ;4BAClC,kCAAkC;4BAClCA,SAASW;wBACX;oBACF;gBACF;gBACAL,MAAMG,KAAK,CAACO,sBAAM,CAACC,IAAI,CAAC,MAAMxB,aAAI,CAACyB,OAAO,CAACf;gBAC3CG,MAAMG,KAAK,CAAC,AAAC,IAAI,CAAkCd,UAAU,CAACsB,IAAI,CAAC,IAAI,EAAEd,UAAUJ;gBACnFO,MAAMG,KAAK,CAACU,wBAAa,CAACF,IAAI,CAAC,MAAMd;gBACrCG,MAAMG,KAAK,CAACW,gBAAK,CAACH,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7CO,MAAMG,KAAK,CAACY,gBAAK,CAACJ,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7CO,MAAMG,KAAK,CAACa,iBAAM,CAACL,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC9CO,MAAMiB,KAAK,CAACvB;YACd,EAAE,OAAOW,KAAK;gBACZX,SAASW;YACX;YACA;QACF;QAEA,OAAO,IAAIa,QAAQ,SAACC,SAASC;mBAAW,MAAK7B,MAAM,CAACC,MAAMC,SAAS,SAACY,KAAagB;uBAAoBhB,MAAMe,OAAOf,OAAOc,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WAnEQ1C"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/FileEntry.ts"],"sourcesContent":["import { rm } from 'fs-remove-compat';\nimport fs from 'graceful-fs';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, FileAttributes, NoParamCallback, WriteFileFn } from './types.ts';\n\ninterface AbstractFileEntry {\n  _writeFile: WriteFileFn;\n}\n\nexport default class FileEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: FileAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'file';\n    if ((this as unknown as AbstractFileEntry)._writeFile === undefined) throw new Error('File this missing _writeFile. Please implement this method in your subclass');\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        } else {\n          // Check if file exists - throw EEXIST if it does\n          queue.defer((callback) => {\n            fs.stat(fullPath, (err) => {\n              if (!err) {\n                const existsErr = new Error(`EEXIST: file already exists, open '${fullPath}'`) as NodeJS.ErrnoException;\n                existsErr.code = 'EEXIST';\n                existsErr.path = fullPath;\n                return callback(existsErr);\n              }\n              // ENOENT means file doesn't exist - that's what we want\n              if (err.code === 'ENOENT') return callback();\n              // Other errors should be reported\n              callback(err);\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer((this as unknown as AbstractFileEntry)._writeFile.bind(this, fullPath, options));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["FileEntry","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","basename","undefined","path","type","_writeFile","Error","create","dest","options","callback","normalizedPath","normalize","fullPath","safeJoinPath","stripPath","queue","Queue","force","defer","rm","err","code","fs","stat","existsErr","mkdirp","bind","dirname","waitForAccess","chmod","chown","utimes","await","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAuBqBA;;;8BAvBF;iEACJ;oEACI;2DACF;8DACC;8DACA;8DACA;+DACC;uBACU;qEACJ;kEACH;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AASvC,IAAA,AAAMD,0BAAN;;aAAMA,UAOPE,UAA0B;gCAPnBF;QAQjBG,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGE,aAAI,CAACF,QAAQ,CAAC,IAAI,CAACE,IAAI;QACxE,IAAI,IAAI,CAACC,IAAI,KAAKF,WAAW,IAAI,CAACE,IAAI,GAAG;QACzC,IAAI,AAAC,IAAI,CAAkCC,UAAU,KAAKH,WAAW,MAAM,IAAII,MAAM;;iBAZpEV;IAkBnBW,OAAAA,MA+CC,GA/CDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBR,aAAI,CAACS,SAAS,CAAC,IAAI,CAACT,IAAI;gBAC/C,IAAMU,WAAWC,IAAAA,uBAAY,EAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAE9D,IAAMO,QAAQ,IAAIC,gBAAK,CAAC;gBACxB,IAAIR,QAAQS,KAAK,EAAE;oBACjBF,MAAMG,KAAK,CAAC,SAACT;wBACXU,IAAAA,kBAAE,EAACP,UAAU,SAACQ;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWZ,SAASW,OAAOX;wBACjD;oBACF;gBACF,OAAO;oBACL,iDAAiD;oBACjDM,MAAMG,KAAK,CAAC,SAACT;wBACXa,mBAAE,CAACC,IAAI,CAACX,UAAU,SAACQ;4BACjB,IAAI,CAACA,KAAK;gCACR,IAAMI,YAAY,IAAInB,MAAM,AAAC,sCAA8C,OAATO,UAAS;gCAC3EY,UAAUH,IAAI,GAAG;gCACjBG,UAAUtB,IAAI,GAAGU;gCACjB,OAAOH,SAASe;4BAClB;4BACA,wDAAwD;4BACxD,IAAIJ,IAAIC,IAAI,KAAK,UAAU,OAAOZ;4BAClC,kCAAkC;4BAClCA,SAASW;wBACX;oBACF;gBACF;gBACAL,MAAMG,KAAK,CAACO,sBAAM,CAACC,IAAI,CAAC,MAAMxB,aAAI,CAACyB,OAAO,CAACf;gBAC3CG,MAAMG,KAAK,CAAC,AAAC,IAAI,CAAkCd,UAAU,CAACsB,IAAI,CAAC,IAAI,EAAEd,UAAUJ;gBACnFO,MAAMG,KAAK,CAACU,wBAAa,CAACF,IAAI,CAAC,MAAMd;gBACrCG,MAAMG,KAAK,CAACW,gBAAK,CAACH,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7CO,MAAMG,KAAK,CAACY,gBAAK,CAACJ,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7CO,MAAMG,KAAK,CAACa,iBAAM,CAACL,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC9CO,MAAMiB,KAAK,CAACvB;YACd,EAAE,OAAOW,KAAK;gBACZX,SAASW;YACX;YACA;QACF;QAEA,OAAO,IAAIa,QAAQ,SAACC,SAASC;mBAAW,MAAK7B,MAAM,CAACC,MAAMC,SAAS,SAACY,KAAagB;uBAAoBhB,MAAMe,OAAOf,OAAOc,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WAnEQ1C"}

package/dist/cjs/LinkEntry.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "default", {
 });
 var _fs = /*#__PURE__*/ _interop_require_default(require("fs"));
 var _fsremovecompat = require("fs-remove-compat");
+var _isabsolute = /*#__PURE__*/ _interop_require_default(require("is-absolute"));
 var _mkdirpclassic = /*#__PURE__*/ _interop_require_default(require("mkdirp-classic"));
 var _path = /*#__PURE__*/ _interop_require_default(require("path"));
 var _queuecb = /*#__PURE__*/ _interop_require_default(require("queue-cb"));
@@ -17,6 +18,7 @@ var _chmodts = /*#__PURE__*/ _interop_require_default(require("./fs/chmod.js"));
 var _chownts = /*#__PURE__*/ _interop_require_default(require("./fs/chown.js"));
 var _utimests = /*#__PURE__*/ _interop_require_default(require("./fs/utimes.js"));
 var _indexts = require("./shared/index.js");
+var _safeJoinPathts = /*#__PURE__*/ _interop_require_default(require("./shared/safeJoinPath.js"));
 var _stripPathts = /*#__PURE__*/ _interop_require_default(require("./shared/stripPath.js"));
 var _validateAttributests = /*#__PURE__*/ _interop_require_default(require("./validateAttributes.js"));
 var _waitForAccessts = /*#__PURE__*/ _interop_require_default(require("./waitForAccess.js"));
@@ -53,9 +55,14 @@ var LinkEntry = /*#__PURE__*/ function() {
         if (typeof callback === 'function') {
             try {
                 var normalizedPath = _path.default.normalize(this.path);
-                var fullPath = _path.default.join(dest, (0, _stripPathts.default)(normalizedPath, options));
+                var fullPath = (0, _safeJoinPathts.default)(dest, (0, _stripPathts.default)(normalizedPath, options));
+                if ((0, _isabsolute.default)(this.linkpath)) {
+                    var _$err = new Error("Absolute linkpath rejected: '".concat(this.linkpath, "'"));
+                    _$err.code = 'ETRAVERSAL';
+                    throw _$err;
+                }
                 var normalizedLinkpath = _path.default.normalize(this.linkpath);
-                var linkFullPath = _path.default.join(dest, (0, _stripPathts.default)(normalizedLinkpath, options));
+                var linkFullPath = (0, _safeJoinPathts.default)(dest, (0, _stripPathts.default)(normalizedLinkpath, options));
                 var queue = new _queuecb.default(1);
                 if (options.force) {
                     queue.defer(function(callback) {

package/dist/cjs/LinkEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/LinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class LinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'link';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n        const normalizedLinkpath = path.normalize(this.linkpath);\n        const linkFullPath = path.join(dest, stripPath(normalizedLinkpath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer(waitForAccess.bind(null, linkFullPath)); // ensure target file is accessible before linking\n        queue.defer(fs.link.bind(fs, linkFullPath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["LinkEntry","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","basename","undefined","path","type","create","dest","options","callback","normalizedPath","normalize","fullPath","join","stripPath","normalizedLinkpath","linkpath","linkFullPath","queue","Queue","force","defer","rm","err","code","mkdirp","bind","dirname","waitForAccess","fs","link","chmod","chown","utimes","await","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAkBqBA;;;yDAlBN;8BACI;oEACA;2DACF;8DACC;8DACA;8DACA;+DACC;uBACU;kEACP;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMD,0BAAN;;aAAMA,UAQPE,UAA0B;gCARnBF;QASjBG,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGE,aAAI,CAACF,QAAQ,CAAC,IAAI,CAACE,IAAI;QACxE,IAAI,IAAI,CAACC,IAAI,KAAKF,WAAW,IAAI,CAACE,IAAI,GAAG;;iBAZxBR;IAkBnBS,OAAAA,MAkCC,GAlCDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBN,aAAI,CAACO,SAAS,CAAC,IAAI,CAACP,IAAI;gBAC/C,IAAMQ,WAAWR,aAAI,CAACS,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAC3D,IAAMO,qBAAqBX,aAAI,CAACO,SAAS,CAAC,IAAI,CAACK,QAAQ;gBACvD,IAAMC,eAAeb,aAAI,CAACS,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACC,oBAAoBP;gBAEnE,IAAMU,QAAQ,IAAIC,gBAAK,CAAC;gBACxB,IAAIX,QAAQY,KAAK,EAAE;oBACjBF,MAAMG,KAAK,CAAC,SAACZ;wBACXa,IAAAA,kBAAE,EAACV,UAAU,SAACW;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWf,SAASc,OAAOd;wBACjD;oBACF;gBACF;gBACAS,MAAMG,KAAK,CAACI,sBAAM,CAACC,IAAI,CAAC,MAAMtB,aAAI,CAACuB,OAAO,CAACf;gBAC3CM,MAAMG,KAAK,CAACO,wBAAa,CAACF,IAAI,CAAC,MAAMT,gBAAgB,kDAAkD;gBACvGC,MAAMG,KAAK,CAACQ,WAAE,CAACC,IAAI,CAACJ,IAAI,CAACG,WAAE,EAAEZ,cAAcL;gBAC3CM,MAAMG,KAAK,CAACO,wBAAa,CAACF,IAAI,CAAC,MAAMd;gBACrCM,MAAMG,KAAK,CAACU,gBAAK,CAACL,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7CU,MAAMG,KAAK,CAACW,gBAAK,CAACN,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7CU,MAAMG,KAAK,CAACY,iBAAM,CAACP,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC9CU,MAAMgB,KAAK,CAACzB;YACd,EAAE,OAAOc,KAAK;gBACZd,SAASc;YACX;YACA;QACF;QAEA,OAAO,IAAIY,QAAQ,SAACC,SAASC;mBAAW,MAAK/B,MAAM,CAACC,MAAMC,SAAS,SAACe,KAAae;uBAAoBf,MAAMc,OAAOd,OAAOa,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WAtDQ1C"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/LinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport isAbsolute from 'is-absolute';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class LinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'link';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n        if (isAbsolute(this.linkpath)) {\n          const err = new Error(`Absolute linkpath rejected: '${this.linkpath}'`) as NodeJS.ErrnoException;\n          err.code = 'ETRAVERSAL';\n          throw err;\n        }\n        const normalizedLinkpath = path.normalize(this.linkpath);\n        const linkFullPath = safeJoinPath(dest, stripPath(normalizedLinkpath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer(waitForAccess.bind(null, linkFullPath)); // ensure target file is accessible before linking\n        queue.defer(fs.link.bind(fs, linkFullPath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["LinkEntry","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","basename","undefined","path","type","create","dest","options","callback","normalizedPath","normalize","fullPath","safeJoinPath","stripPath","isAbsolute","linkpath","err","Error","code","normalizedLinkpath","linkFullPath","queue","Queue","force","defer","rm","mkdirp","bind","dirname","waitForAccess","fs","link","chmod","chown","utimes","await","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAoBqBA;;;yDApBN;8BACI;iEACI;oEACJ;2DACF;8DACC;8DACA;8DACA;+DACC;uBACU;qEACJ;kEACH;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMD,0BAAN;;aAAMA,UAQPE,UAA0B;gCARnBF;QASjBG,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGE,aAAI,CAACF,QAAQ,CAAC,IAAI,CAACE,IAAI;QACxE,IAAI,IAAI,CAACC,IAAI,KAAKF,WAAW,IAAI,CAACE,IAAI,GAAG;;iBAZxBR;IAkBnBS,OAAAA,MAuCC,GAvCDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBN,aAAI,CAACO,SAAS,CAAC,IAAI,CAACP,IAAI;gBAC/C,IAAMQ,WAAWC,IAAAA,uBAAY,EAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAC9D,IAAIO,IAAAA,mBAAU,EAAC,IAAI,CAACC,QAAQ,GAAG;oBAC7B,IAAMC,QAAM,IAAIC,MAAM,AAAC,gCAA6C,OAAd,IAAI,CAACF,QAAQ,EAAC;oBACpEC,MAAIE,IAAI,GAAG;oBACX,MAAMF;gBACR;gBACA,IAAMG,qBAAqBhB,aAAI,CAACO,SAAS,CAAC,IAAI,CAACK,QAAQ;gBACvD,IAAMK,eAAeR,IAAAA,uBAAY,EAACN,MAAMO,IAAAA,oBAAS,EAACM,oBAAoBZ;gBAEtE,IAAMc,QAAQ,IAAIC,gBAAK,CAAC;gBACxB,IAAIf,QAAQgB,KAAK,EAAE;oBACjBF,MAAMG,KAAK,CAAC,SAAChB;wBACXiB,IAAAA,kBAAE,EAACd,UAAU,SAACK;4BACZA,OAAOA,IAAIE,IAAI,KAAK,WAAWV,SAASQ,OAAOR;wBACjD;oBACF;gBACF;gBACAa,MAAMG,KAAK,CAACE,sBAAM,CAACC,IAAI,CAAC,MAAMxB,aAAI,CAACyB,OAAO,CAACjB;gBAC3CU,MAAMG,KAAK,CAACK,wBAAa,CAACF,IAAI,CAAC,MAAMP,gBAAgB,kDAAkD;gBACvGC,MAAMG,KAAK,CAACM,WAAE,CAACC,IAAI,CAACJ,IAAI,CAACG,WAAE,EAAEV,cAAcT;gBAC3CU,MAAMG,KAAK,CAACK,wBAAa,CAACF,IAAI,CAAC,MAAMhB;gBACrCU,MAAMG,KAAK,CAACQ,gBAAK,CAACL,IAAI,CAAC,MAAMhB,UAAU,IAAI,EAAEJ;gBAC7Cc,MAAMG,KAAK,CAACS,gBAAK,CAACN,IAAI,CAAC,MAAMhB,UAAU,IAAI,EAAEJ;gBAC7Cc,MAAMG,KAAK,CAACU,iBAAM,CAACP,IAAI,CAAC,MAAMhB,UAAU,IAAI,EAAEJ;gBAC9Cc,MAAMc,KAAK,CAAC3B;YACd,EAAE,OAAOQ,KAAK;gBACZR,SAASQ;YACX;YACA;QACF;QAEA,OAAO,IAAIoB,QAAQ,SAACC,SAASC;mBAAW,MAAKjC,MAAM,CAACC,MAAMC,SAAS,SAACS,KAAauB;uBAAoBvB,MAAMsB,OAAOtB,OAAOqB,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WA3DQ5C"}

package/dist/cjs/SymbolicLinkEntry.js

@@ -19,6 +19,7 @@ var _chownts = /*#__PURE__*/ _interop_require_default(require("./fs/chown.js"));
 var _lutimests = /*#__PURE__*/ _interop_require_default(require("./fs/lutimes.js"));
 var _symlinkWin32ts = /*#__PURE__*/ _interop_require_default(require("./fs/symlinkWin32.js"));
 var _indexts = require("./shared/index.js");
+var _safeJoinPathts = /*#__PURE__*/ _interop_require_default(require("./shared/safeJoinPath.js"));
 var _stripPathts = /*#__PURE__*/ _interop_require_default(require("./shared/stripPath.js"));
 var _validateAttributests = /*#__PURE__*/ _interop_require_default(require("./validateAttributes.js"));
 var _waitForAccessts = /*#__PURE__*/ _interop_require_default(require("./waitForAccess.js"));
@@ -56,14 +57,18 @@ var SymbolicLinkEntry = /*#__PURE__*/ function() {
         if (typeof callback === 'function') {
             try {
                 var normalizedPath = _path.default.normalize(this.path);
-                var fullPath = _path.default.join(dest, (0, _stripPathts.default)(normalizedPath, options));
-                var normalizedLinkpath = _path.default.normalize(this.linkpath);
-                var linkFullPath = _path.default.join(dest, (0, _stripPathts.default)(normalizedLinkpath, options));
-                if (!(0, _isabsolute.default)(normalizedLinkpath)) {
-                    var linkRelativePath = _path.default.join(_path.default.dirname(normalizedPath), this.linkpath);
-                    linkFullPath = _path.default.join(dest, (0, _stripPathts.default)(linkRelativePath, options));
-                    normalizedLinkpath = _path.default.relative(_path.default.dirname(fullPath), linkFullPath);
+                var fullPath = (0, _safeJoinPathts.default)(dest, (0, _stripPathts.default)(normalizedPath, options));
+                if ((0, _isabsolute.default)(this.linkpath)) {
+                    var _$err = new Error("Absolute linkpath rejected: '".concat(this.linkpath, "'"));
+                    _$err.code = 'ETRAVERSAL';
+                    throw _$err;
                 }
+                // Resolve the symlink target against the symlink's own directory and verify it
+                // stays within dest. safeJoinPath throws ETRAVERSAL if it escapes.
+                var targetAbs = _path.default.resolve(_path.default.dirname(fullPath), this.linkpath);
+                (0, _safeJoinPathts.default)(dest, _path.default.relative(dest, targetAbs));
+                var normalizedLinkpath = _path.default.relative(_path.default.dirname(fullPath), targetAbs);
+                var linkFullPath = targetAbs;
                 var queue = new _queuecb.default(1);
                 if (options.force) {
                     queue.defer(function(callback) {

package/dist/cjs/SymbolicLinkEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/SymbolicLinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport isAbsolute from 'is-absolute';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport lutimes from './fs/lutimes.ts';\nimport symlinkWin32 from './fs/symlinkWin32.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst isWindows = process.platform === 'win32' || /^(msys|cygwin)$/.test(process.env.OSTYPE);\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class SymbolicLinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'symlink';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n        let normalizedLinkpath = path.normalize(this.linkpath);\n        let linkFullPath = path.join(dest, stripPath(normalizedLinkpath, options));\n        if (!isAbsolute(normalizedLinkpath)) {\n          const linkRelativePath = path.join(path.dirname(normalizedPath), this.linkpath);\n          linkFullPath = path.join(dest, stripPath(linkRelativePath, options));\n          normalizedLinkpath = path.relative(path.dirname(fullPath), linkFullPath);\n        }\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        if (isWindows) queue.defer(symlinkWin32.bind(null, linkFullPath, normalizedLinkpath, fullPath));\n        else queue.defer(fs.symlink.bind(fs, normalizedLinkpath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath, true)); // noFollow=true for symlinks\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(lutimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["SymbolicLinkEntry","isWindows","process","platform","test","env","OSTYPE","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","basename","undefined","path","type","create","dest","options","callback","normalizedPath","normalize","fullPath","join","stripPath","normalizedLinkpath","linkpath","linkFullPath","isAbsolute","linkRelativePath","dirname","relative","queue","Queue","force","defer","rm","err","code","mkdirp","bind","symlinkWin32","fs","symlink","waitForAccess","chmod","chown","lutimes","await","Promise","resolve","reject","done","destroy"],"mappings":";;;;;;;eAsBqBA;;;yDAtBN;8BACI;iEACI;oEACJ;2DACF;8DACC;8DACA;8DACA;gEACE;qEACK;uBACI;kEACP;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,YAAYC,QAAQC,QAAQ,KAAK,WAAW,kBAAkBC,IAAI,CAACF,QAAQG,GAAG,CAACC,MAAM;AAE3F,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMP,kCAAN;;aAAMA,kBAQPQ,UAA0B;gCARnBR;QASjBS,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGE,aAAI,CAACF,QAAQ,CAAC,IAAI,CAACE,IAAI;QACxE,IAAI,IAAI,CAACC,IAAI,KAAKF,WAAW,IAAI,CAACE,IAAI,GAAG;;iBAZxBd;IAkBnBe,OAAAA,MAuCC,GAvCDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBN,aAAI,CAACO,SAAS,CAAC,IAAI,CAACP,IAAI;gBAC/C,IAAMQ,WAAWR,aAAI,CAACS,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAC3D,IAAIO,qBAAqBX,aAAI,CAACO,SAAS,CAAC,IAAI,CAACK,QAAQ;gBACrD,IAAIC,eAAeb,aAAI,CAACS,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACC,oBAAoBP;gBACjE,IAAI,CAACU,IAAAA,mBAAU,EAACH,qBAAqB;oBACnC,IAAMI,mBAAmBf,aAAI,CAACS,IAAI,CAACT,aAAI,CAACgB,OAAO,CAACV,iBAAiB,IAAI,CAACM,QAAQ;oBAC9EC,eAAeb,aAAI,CAACS,IAAI,CAACN,MAAMO,IAAAA,oBAAS,EAACK,kBAAkBX;oBAC3DO,qBAAqBX,aAAI,CAACiB,QAAQ,CAACjB,aAAI,CAACgB,OAAO,CAACR,WAAWK;gBAC7D;gBAEA,IAAMK,QAAQ,IAAIC,gBAAK,CAAC;gBACxB,IAAIf,QAAQgB,KAAK,EAAE;oBACjBF,MAAMG,KAAK,CAAC,SAAChB;wBACXiB,IAAAA,kBAAE,EAACd,UAAU,SAACe;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWnB,SAASkB,OAAOlB;wBACjD;oBACF;gBACF;gBACAa,MAAMG,KAAK,CAACI,sBAAM,CAACC,IAAI,CAAC,MAAM1B,aAAI,CAACgB,OAAO,CAACR;gBAC3C,IAAIpB,WAAW8B,MAAMG,KAAK,CAACM,uBAAY,CAACD,IAAI,CAAC,MAAMb,cAAcF,oBAAoBH;qBAChFU,MAAMG,KAAK,CAACO,WAAE,CAACC,OAAO,CAACH,IAAI,CAACE,WAAE,EAAEjB,oBAAoBH;gBACzDU,MAAMG,KAAK,CAACS,wBAAa,CAACJ,IAAI,CAAC,MAAMlB,UAAU,QAAQ,6BAA6B;gBACpFU,MAAMG,KAAK,CAACU,gBAAK,CAACL,IAAI,CAAC,MAAMlB,UAAU,IAAI,EAAEJ;gBAC7Cc,MAAMG,KAAK,CAACW,gBAAK,CAACN,IAAI,CAAC,MAAMlB,UAAU,IAAI,EAAEJ;gBAC7Cc,MAAMG,KAAK,CAACY,kBAAO,CAACP,IAAI,CAAC,MAAMlB,UAAU,IAAI,EAAEJ;gBAC/Cc,MAAMgB,KAAK,CAAC7B;YACd,EAAE,OAAOkB,KAAK;gBACZlB,SAASkB;YACX;YACA;QACF;QAEA,OAAO,IAAIY,QAAQ,SAACC,SAASC;mBAAW,MAAKnC,MAAM,CAACC,MAAMC,SAAS,SAACmB,KAAae;uBAAoBf,MAAMc,OAAOd,OAAOa,QAAQE;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WA3DQpD"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/SymbolicLinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport isAbsolute from 'is-absolute';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport lutimes from './fs/lutimes.ts';\nimport symlinkWin32 from './fs/symlinkWin32.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst isWindows = process.platform === 'win32' || /^(msys|cygwin)$/.test(process.env.OSTYPE);\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class SymbolicLinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'symlink';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n\n        if (isAbsolute(this.linkpath)) {\n          const err = new Error(`Absolute linkpath rejected: '${this.linkpath}'`) as NodeJS.ErrnoException;\n          err.code = 'ETRAVERSAL';\n          throw err;\n        }\n        // Resolve the symlink target against the symlink's own directory and verify it\n        // stays within dest. safeJoinPath throws ETRAVERSAL if it escapes.\n        const targetAbs = path.resolve(path.dirname(fullPath), this.linkpath);\n        safeJoinPath(dest, path.relative(dest, targetAbs));\n        const normalizedLinkpath = path.relative(path.dirname(fullPath), targetAbs);\n        const linkFullPath = targetAbs;\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        if (isWindows) queue.defer(symlinkWin32.bind(null, linkFullPath, normalizedLinkpath, fullPath));\n        else queue.defer(fs.symlink.bind(fs, normalizedLinkpath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath, true)); // noFollow=true for symlinks\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(lutimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["SymbolicLinkEntry","isWindows","process","platform","test","env","OSTYPE","MANDATORY_ATTRIBUTES","attributes","validateAttributes","objectAssign","basename","undefined","path","type","create","dest","options","callback","normalizedPath","normalize","fullPath","safeJoinPath","stripPath","isAbsolute","linkpath","err","Error","code","targetAbs","resolve","dirname","relative","normalizedLinkpath","linkFullPath","queue","Queue","force","defer","rm","mkdirp","bind","symlinkWin32","fs","symlink","waitForAccess","chmod","chown","lutimes","await","Promise","reject","done","destroy"],"mappings":";;;;;;;eAuBqBA;;;yDAvBN;8BACI;iEACI;oEACJ;2DACF;8DACC;8DACA;8DACA;gEACE;qEACK;uBACI;qEACJ;kEACH;2EACS;sEACL;;;;;;;;;;;AAE1B,IAAMC,YAAYC,QAAQC,QAAQ,KAAK,WAAW,kBAAkBC,IAAI,CAACF,QAAQG,GAAG,CAACC,MAAM;AAE3F,IAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMP,kCAAN;;aAAMA,kBAQPQ,UAA0B;gCARnBR;QASjBS,IAAAA,6BAAkB,EAACD,YAAYD;QAC/BG,IAAAA,qBAAY,EAAC,IAAI,EAAEF;QACnB,IAAI,IAAI,CAACG,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGE,aAAI,CAACF,QAAQ,CAAC,IAAI,CAACE,IAAI;QACxE,IAAI,IAAI,CAACC,IAAI,KAAKF,WAAW,IAAI,CAACE,IAAI,GAAG;;iBAZxBd;IAkBnBe,OAAAA,MA4CC,GA5CDA,SAAAA,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B;;QACzFA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,IAAMC,iBAAiBN,aAAI,CAACO,SAAS,CAAC,IAAI,CAACP,IAAI;gBAC/C,IAAMQ,WAAWC,IAAAA,uBAAY,EAACN,MAAMO,IAAAA,oBAAS,EAACJ,gBAAgBF;gBAE9D,IAAIO,IAAAA,mBAAU,EAAC,IAAI,CAACC,QAAQ,GAAG;oBAC7B,IAAMC,QAAM,IAAIC,MAAM,AAAC,gCAA6C,OAAd,IAAI,CAACF,QAAQ,EAAC;oBACpEC,MAAIE,IAAI,GAAG;oBACX,MAAMF;gBACR;gBACA,+EAA+E;gBAC/E,mEAAmE;gBACnE,IAAMG,YAAYhB,aAAI,CAACiB,OAAO,CAACjB,aAAI,CAACkB,OAAO,CAACV,WAAW,IAAI,CAACI,QAAQ;gBACpEH,IAAAA,uBAAY,EAACN,MAAMH,aAAI,CAACmB,QAAQ,CAAChB,MAAMa;gBACvC,IAAMI,qBAAqBpB,aAAI,CAACmB,QAAQ,CAACnB,aAAI,CAACkB,OAAO,CAACV,WAAWQ;gBACjE,IAAMK,eAAeL;gBAErB,IAAMM,QAAQ,IAAIC,gBAAK,CAAC;gBACxB,IAAInB,QAAQoB,KAAK,EAAE;oBACjBF,MAAMG,KAAK,CAAC,SAACpB;wBACXqB,IAAAA,kBAAE,EAAClB,UAAU,SAACK;4BACZA,OAAOA,IAAIE,IAAI,KAAK,WAAWV,SAASQ,OAAOR;wBACjD;oBACF;gBACF;gBACAiB,MAAMG,KAAK,CAACE,sBAAM,CAACC,IAAI,CAAC,MAAM5B,aAAI,CAACkB,OAAO,CAACV;gBAC3C,IAAIpB,WAAWkC,MAAMG,KAAK,CAACI,uBAAY,CAACD,IAAI,CAAC,MAAMP,cAAcD,oBAAoBZ;qBAChFc,MAAMG,KAAK,CAACK,WAAE,CAACC,OAAO,CAACH,IAAI,CAACE,WAAE,EAAEV,oBAAoBZ;gBACzDc,MAAMG,KAAK,CAACO,wBAAa,CAACJ,IAAI,CAAC,MAAMpB,UAAU,QAAQ,6BAA6B;gBACpFc,MAAMG,KAAK,CAACQ,gBAAK,CAACL,IAAI,CAAC,MAAMpB,UAAU,IAAI,EAAEJ;gBAC7CkB,MAAMG,KAAK,CAACS,gBAAK,CAACN,IAAI,CAAC,MAAMpB,UAAU,IAAI,EAAEJ;gBAC7CkB,MAAMG,KAAK,CAACU,kBAAO,CAACP,IAAI,CAAC,MAAMpB,UAAU,IAAI,EAAEJ;gBAC/CkB,MAAMc,KAAK,CAAC/B;YACd,EAAE,OAAOQ,KAAK;gBACZR,SAASQ;YACX;YACA;QACF;QAEA,OAAO,IAAIwB,QAAQ,SAACpB,SAASqB;mBAAW,MAAKpC,MAAM,CAACC,MAAMC,SAAS,SAACS,KAAa0B;uBAAoB1B,MAAMyB,OAAOzB,OAAOI,QAAQsB;;;IACnI;IAEAC,OAAAA,OAAY,GAAZA,SAAAA,WAAW;WAhEQrD"}

package/dist/cjs/shared/index.d.cts

@@ -22,5 +22,6 @@ export { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.js';
 export { default as EntryStream } from './EntryStream.js';
 export { type CleanupFn, default as Lock } from './Lock.js';
 export { default as normalizePath } from './normalizePath.js';
+export { default as safeJoinPath } from './safeJoinPath.js';
 export { default as streamToString, type StreamToStringCallback } from './streamToString.js';
 export { default as stripPath } from './stripPath.js';

package/dist/cjs/shared/index.d.ts

@@ -22,5 +22,6 @@ export { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.js';
 export { default as EntryStream } from './EntryStream.js';
 export { type CleanupFn, default as Lock } from './Lock.js';
 export { default as normalizePath } from './normalizePath.js';
+export { default as safeJoinPath } from './safeJoinPath.js';
 export { default as streamToString, type StreamToStringCallback } from './streamToString.js';
 export { default as stripPath } from './stripPath.js';

package/dist/cjs/shared/index.js

@@ -91,6 +91,9 @@ _export(exports, {
     get readUInt64LE () {
         return _compatts.readUInt64LE;
     },
+    get safeJoinPath () {
+        return _safeJoinPathts.default;
+    },
     get streamToString () {
         return _streamToStringts.default;
     },
@@ -113,6 +116,7 @@ var _crc32ts = require("./crc32.js");
 var _EntryStreamts = /*#__PURE__*/ _interop_require_default(require("./EntryStream.js"));
 var _Lockts = /*#__PURE__*/ _interop_require_default(require("./Lock.js"));
 var _normalizePathts = /*#__PURE__*/ _interop_require_default(require("./normalizePath.js"));
+var _safeJoinPathts = /*#__PURE__*/ _interop_require_default(require("./safeJoinPath.js"));
 var _streamToStringts = /*#__PURE__*/ _interop_require_default(require("./streamToString.js"));
 var _stripPathts = /*#__PURE__*/ _interop_require_default(require("./stripPath.js"));
 function _interop_require_default(obj) {

package/dist/cjs/shared/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/shared/index.ts"],"sourcesContent":["/**\n * Shared utilities for iterator libraries\n *\n * These utilities are designed to be used by:\n * - zip-iterator\n * - 7z-iterator\n * - tar-iterator\n * - Any other archive iterator library\n *\n * All utilities support Node.js 0.8+\n */\n\nimport BufferList from './BufferList.ts';\n\nexport { BufferList };\n\n/**\n * Type alias for Buffer or BufferList - both can be read byte-by-byte.\n * Use this when an API should accept either contiguous data (Buffer)\n * or chunked streaming data (BufferList).\n */\nexport type BufferLike = Buffer | BufferList;\nexport {\n  allocBuffer,\n  allocBufferUnsafe,\n  bufferCompare,\n  bufferConcat,\n  bufferEquals,\n  bufferFrom,\n  bufferSliceCopy,\n  canAllocateBufferSize,\n  createInflateRawStream,\n  inflateRaw,\n  isNaN,\n  MAX_SAFE_BUFFER_LENGTH,\n  objectAssign,\n  PassThrough,\n  Readable,\n  readUInt64LE,\n  Transform,\n  Writable,\n  writeUInt64LE,\n} from './compat.ts';\nexport { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.ts';\nexport { default as EntryStream } from './EntryStream.ts';\nexport { type CleanupFn, default as Lock } from './Lock.ts';\nexport { default as normalizePath } from './normalizePath.ts';\nexport { default as streamToString, type StreamToStringCallback } from './streamToString.ts';\nexport { default as stripPath } from './stripPath.ts';\n"],"names":["BufferList","EntryStream","Lock","MAX_SAFE_BUFFER_LENGTH","PassThrough","Readable","Transform","Writable","allocBuffer","allocBufferUnsafe","bufferCompare","bufferConcat","bufferEquals","bufferFrom","bufferSliceCopy","canAllocateBufferSize","crc32","crc32Region","createInflateRawStream","inflateRaw","isNaN","normalizePath","objectAssign","readUInt64LE","streamToString","stripPath","verifyCrc32","verifyCrc32Region","writeUInt64LE"],"mappings":"AAAA;;;;;;;;;;CAUC;;;;;;;;;;;QAIQA;eAAAA,qBAAU;;QA8BCC;eAAAA,sBAAW;;QACKC;eAAAA,eAAI;;QAXtCC;eAAAA,gCAAsB;;QAEtBC;eAAAA,qBAAW;;QACXC;eAAAA,kBAAQ;;QAERC;eAAAA,mBAAS;;QACTC;eAAAA,kBAAQ;;QAjBRC;eAAAA,qBAAW;;QACXC;eAAAA,2BAAiB;;QACjBC;eAAAA,uBAAa;;QACbC;eAAAA,sBAAY;;QACZC;eAAAA,sBAAY;;QACZC;eAAAA,oBAAU;;QACVC;eAAAA,yBAAe;;QACfC;eAAAA,+BAAqB;;QAadC;eAAAA,cAAK;;QAAEC;eAAAA,oBAAW;;QAZzBC;eAAAA,gCAAsB;;QACtBC;eAAAA,oBAAU;;QACVC;eAAAA,eAAK;;QAaaC;eAAAA,wBAAa;;QAX/BC;eAAAA,sBAAY;;QAGZC;eAAAA,sBAAY;;QASMC;eAAAA,yBAAc;;QACdC;eAAAA,oBAAS;;QALAC;eAAAA,oBAAW;;QAAEC;eAAAA,0BAAiB;;QAFzDC;eAAAA,uBAAa;;;mEA7BQ;wBA8BhB;uBAC4D;oEAC5B;6DACS;sEACP;uEAC8B;kEAClC"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/shared/index.ts"],"sourcesContent":["/**\n * Shared utilities for iterator libraries\n *\n * These utilities are designed to be used by:\n * - zip-iterator\n * - 7z-iterator\n * - tar-iterator\n * - Any other archive iterator library\n *\n * All utilities support Node.js 0.8+\n */\n\nimport BufferList from './BufferList.ts';\n\nexport { BufferList };\n\n/**\n * Type alias for Buffer or BufferList - both can be read byte-by-byte.\n * Use this when an API should accept either contiguous data (Buffer)\n * or chunked streaming data (BufferList).\n */\nexport type BufferLike = Buffer | BufferList;\nexport {\n  allocBuffer,\n  allocBufferUnsafe,\n  bufferCompare,\n  bufferConcat,\n  bufferEquals,\n  bufferFrom,\n  bufferSliceCopy,\n  canAllocateBufferSize,\n  createInflateRawStream,\n  inflateRaw,\n  isNaN,\n  MAX_SAFE_BUFFER_LENGTH,\n  objectAssign,\n  PassThrough,\n  Readable,\n  readUInt64LE,\n  Transform,\n  Writable,\n  writeUInt64LE,\n} from './compat.ts';\nexport { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.ts';\nexport { default as EntryStream } from './EntryStream.ts';\nexport { type CleanupFn, default as Lock } from './Lock.ts';\nexport { default as normalizePath } from './normalizePath.ts';\nexport { default as safeJoinPath } from './safeJoinPath.ts';\nexport { default as streamToString, type StreamToStringCallback } from './streamToString.ts';\nexport { default as stripPath } from './stripPath.ts';\n"],"names":["BufferList","EntryStream","Lock","MAX_SAFE_BUFFER_LENGTH","PassThrough","Readable","Transform","Writable","allocBuffer","allocBufferUnsafe","bufferCompare","bufferConcat","bufferEquals","bufferFrom","bufferSliceCopy","canAllocateBufferSize","crc32","crc32Region","createInflateRawStream","inflateRaw","isNaN","normalizePath","objectAssign","readUInt64LE","safeJoinPath","streamToString","stripPath","verifyCrc32","verifyCrc32Region","writeUInt64LE"],"mappings":"AAAA;;;;;;;;;;CAUC;;;;;;;;;;;QAIQA;eAAAA,qBAAU;;QA8BCC;eAAAA,sBAAW;;QACKC;eAAAA,eAAI;;QAXtCC;eAAAA,gCAAsB;;QAEtBC;eAAAA,qBAAW;;QACXC;eAAAA,kBAAQ;;QAERC;eAAAA,mBAAS;;QACTC;eAAAA,kBAAQ;;QAjBRC;eAAAA,qBAAW;;QACXC;eAAAA,2BAAiB;;QACjBC;eAAAA,uBAAa;;QACbC;eAAAA,sBAAY;;QACZC;eAAAA,sBAAY;;QACZC;eAAAA,oBAAU;;QACVC;eAAAA,yBAAe;;QACfC;eAAAA,+BAAqB;;QAadC;eAAAA,cAAK;;QAAEC;eAAAA,oBAAW;;QAZzBC;eAAAA,gCAAsB;;QACtBC;eAAAA,oBAAU;;QACVC;eAAAA,eAAK;;QAaaC;eAAAA,wBAAa;;QAX/BC;eAAAA,sBAAY;;QAGZC;eAAAA,sBAAY;;QASMC;eAAAA,uBAAY;;QACZC;eAAAA,yBAAc;;QACdC;eAAAA,oBAAS;;QANAC;eAAAA,oBAAW;;QAAEC;eAAAA,0BAAiB;;QAFzDC;eAAAA,uBAAa;;;mEA7BQ;wBA8BhB;uBAC4D;oEAC5B;6DACS;sEACP;qEACD;uEAC+B;kEAClC"}

package/dist/cjs/shared/safeJoinPath.d.cts

@@ -0,0 +1 @@
+export default function safeJoinPath(dest: string, relPath: string): string;

package/dist/cjs/shared/safeJoinPath.d.ts

@@ -0,0 +1 @@
+export default function safeJoinPath(dest: string, relPath: string): string;

package/dist/cjs/shared/safeJoinPath.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "default", {
+    enumerable: true,
+    get: function() {
+        return safeJoinPath;
+    }
+});
+var _path = /*#__PURE__*/ _interop_require_default(require("path"));
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function safeJoinPath(dest, relPath) {
+    var resolvedDest = _path.default.resolve(dest);
+    var resolvedFull = _path.default.resolve(dest, relPath);
+    if (resolvedFull !== resolvedDest && !resolvedFull.startsWith(resolvedDest + _path.default.sep)) {
+        var err = new Error("Path traversal detected: '".concat(relPath, "' escapes destination '").concat(dest, "'"));
+        err.code = 'ETRAVERSAL';
+        throw err;
+    }
+    return resolvedFull;
+}
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/shared/safeJoinPath.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/shared/safeJoinPath.ts"],"sourcesContent":["import path from 'path';\n\nexport default function safeJoinPath(dest: string, relPath: string): string {\n  const resolvedDest = path.resolve(dest);\n  const resolvedFull = path.resolve(dest, relPath);\n  if (resolvedFull !== resolvedDest && !resolvedFull.startsWith(resolvedDest + path.sep)) {\n    const err = new Error(`Path traversal detected: '${relPath}' escapes destination '${dest}'`) as NodeJS.ErrnoException;\n    err.code = 'ETRAVERSAL';\n    throw err;\n  }\n  return resolvedFull;\n}\n"],"names":["safeJoinPath","dest","relPath","resolvedDest","path","resolve","resolvedFull","startsWith","sep","err","Error","code"],"mappings":";;;;+BAEA;;;eAAwBA;;;2DAFP;;;;;;AAEF,SAASA,aAAaC,IAAY,EAAEC,OAAe;IAChE,IAAMC,eAAeC,aAAI,CAACC,OAAO,CAACJ;IAClC,IAAMK,eAAeF,aAAI,CAACC,OAAO,CAACJ,MAAMC;IACxC,IAAII,iBAAiBH,gBAAgB,CAACG,aAAaC,UAAU,CAACJ,eAAeC,aAAI,CAACI,GAAG,GAAG;QACtF,IAAMC,MAAM,IAAIC,MAAM,AAAC,6BAA6DT,OAAjCC,SAAQ,2BAA8B,OAALD,MAAK;QACzFQ,IAAIE,IAAI,GAAG;QACX,MAAMF;IACR;IACA,OAAOH;AACT"}

package/dist/esm/DirectoryEntry.js

@@ -5,6 +5,7 @@ import chmod from './fs/chmod.js';
 import chown from './fs/chown.js';
 import utimes from './fs/utimes.js';
 import { objectAssign } from './shared/index.js';
+import safeJoinPath from './shared/safeJoinPath.js';
 import stripPath from './shared/stripPath.js';
 import validateAttributes from './validateAttributes.js';
 import waitForAccess from './waitForAccess.js';
@@ -20,7 +21,7 @@ let DirectoryEntry = class DirectoryEntry {
         if (typeof callback === 'function') {
             try {
                 const normalizedPath = path.normalize(this.path);
-                const fullPath = path.join(dest, stripPath(normalizedPath, options));
+                const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));
                 // do not check for the existence of the directory but allow out-of-order calling
                 const queue = new Queue(1);
                 queue.defer(mkdirp.bind(null, fullPath));

package/dist/esm/DirectoryEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/DirectoryEntry.ts"],"sourcesContent":["import mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { DirectoryAttributes, ExtractOptions, NoParamCallback } from './types.ts';\n\nexport default class DirectoryEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: DirectoryAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.type === undefined) this.type = 'directory';\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n\n        // do not check for the existence of the directory but allow out-of-order calling\n        const queue = new Queue(1);\n        queue.defer(mkdirp.bind(null, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["mkdirp","path","Queue","chmod","chown","utimes","objectAssign","stripPath","validateAttributes","waitForAccess","MANDATORY_ATTRIBUTES","DirectoryEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","join","queue","defer","bind","await","err","Promise","resolve","reject","done","destroy","attributes","type","undefined","basename"],"mappings":"AAAA,OAAOA,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,YAAY,iBAAiB;AACpC,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AAKvC,IAAA,AAAMC,iBAAN,MAAMA;IAiBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBf,KAAKgB,SAAS,CAAC,IAAI,CAAChB,IAAI;gBAC/C,MAAMiB,WAAWjB,KAAKkB,IAAI,CAACN,MAAMN,UAAUS,gBAAgBF;gBAE3D,iFAAiF;gBACjF,MAAMM,QAAQ,IAAIlB,MAAM;gBACxBkB,MAAMC,KAAK,CAACrB,OAAOsB,IAAI,CAAC,MAAMJ;gBAC9BE,MAAMC,KAAK,CAACZ,cAAca,IAAI,CAAC,MAAMJ;gBACrCE,MAAMC,KAAK,CAAClB,MAAMmB,IAAI,CAAC,MAAMJ,UAAU,IAAI,EAAEJ;gBAC7CM,MAAMC,KAAK,CAACjB,MAAMkB,IAAI,CAAC,MAAMJ,UAAU,IAAI,EAAEJ;gBAC7CM,MAAMC,KAAK,CAAChB,OAAOiB,IAAI,CAAC,MAAMJ,UAAU,IAAI,EAAEJ;gBAC9CM,MAAMG,KAAK,CAACR;YACd,EAAE,OAAOS,KAAK;gBACZT,SAASS;YACX;YACA;QACF;QAEA,OAAO,IAAIC,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACf,MAAM,CAACC,MAAMC,SAAS,CAACU,KAAaI,OAAoBJ,MAAMG,OAAOH,OAAOE,QAAQE;IACnI;IAEAC,UAAU,CAAC;IApCX,YAAYC,UAA+B,CAAE;QAC3CtB,mBAAmBsB,YAAYpB;QAC/BJ,aAAa,IAAI,EAAEwB;QACnB,IAAI,IAAI,CAACC,IAAI,KAAKC,WAAW,IAAI,CAACD,IAAI,GAAG;QACzC,IAAI,IAAI,CAACE,QAAQ,KAAKD,WAAW,IAAI,CAACC,QAAQ,GAAGhC,KAAKgC,QAAQ,CAAC,IAAI,CAAChC,IAAI;IAC1E;AAgCF;AA5CA,SAAqBU,4BA4CpB"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/DirectoryEntry.ts"],"sourcesContent":["import mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { DirectoryAttributes, ExtractOptions, NoParamCallback } from './types.ts';\n\nexport default class DirectoryEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: DirectoryAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.type === undefined) this.type = 'directory';\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n\n        // do not check for the existence of the directory but allow out-of-order calling\n        const queue = new Queue(1);\n        queue.defer(mkdirp.bind(null, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["mkdirp","path","Queue","chmod","chown","utimes","objectAssign","safeJoinPath","stripPath","validateAttributes","waitForAccess","MANDATORY_ATTRIBUTES","DirectoryEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","queue","defer","bind","await","err","Promise","resolve","reject","done","destroy","attributes","type","undefined","basename"],"mappings":"AAAA,OAAOA,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,YAAY,iBAAiB;AACpC,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,kBAAkB,2BAA2B;AACpD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AAKvC,IAAA,AAAMC,iBAAN,MAAMA;IAiBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBhB,KAAKiB,SAAS,CAAC,IAAI,CAACjB,IAAI;gBAC/C,MAAMkB,WAAWZ,aAAaO,MAAMN,UAAUS,gBAAgBF;gBAE9D,iFAAiF;gBACjF,MAAMK,QAAQ,IAAIlB,MAAM;gBACxBkB,MAAMC,KAAK,CAACrB,OAAOsB,IAAI,CAAC,MAAMH;gBAC9BC,MAAMC,KAAK,CAACX,cAAcY,IAAI,CAAC,MAAMH;gBACrCC,MAAMC,KAAK,CAAClB,MAAMmB,IAAI,CAAC,MAAMH,UAAU,IAAI,EAAEJ;gBAC7CK,MAAMC,KAAK,CAACjB,MAAMkB,IAAI,CAAC,MAAMH,UAAU,IAAI,EAAEJ;gBAC7CK,MAAMC,KAAK,CAAChB,OAAOiB,IAAI,CAAC,MAAMH,UAAU,IAAI,EAAEJ;gBAC9CK,MAAMG,KAAK,CAACP;YACd,EAAE,OAAOQ,KAAK;gBACZR,SAASQ;YACX;YACA;QACF;QAEA,OAAO,IAAIC,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACd,MAAM,CAACC,MAAMC,SAAS,CAACS,KAAaI,OAAoBJ,MAAMG,OAAOH,OAAOE,QAAQE;IACnI;IAEAC,UAAU,CAAC;IApCX,YAAYC,UAA+B,CAAE;QAC3CrB,mBAAmBqB,YAAYnB;QAC/BL,aAAa,IAAI,EAAEwB;QACnB,IAAI,IAAI,CAACC,IAAI,KAAKC,WAAW,IAAI,CAACD,IAAI,GAAG;QACzC,IAAI,IAAI,CAACE,QAAQ,KAAKD,WAAW,IAAI,CAACC,QAAQ,GAAGhC,KAAKgC,QAAQ,CAAC,IAAI,CAAChC,IAAI;IAC1E;AAgCF;AA5CA,SAAqBW,4BA4CpB"}

package/dist/esm/FileEntry.js

@@ -7,6 +7,7 @@ import chmod from './fs/chmod.js';
 import chown from './fs/chown.js';
 import utimes from './fs/utimes.js';
 import { objectAssign } from './shared/index.js';
+import safeJoinPath from './shared/safeJoinPath.js';
 import stripPath from './shared/stripPath.js';
 import validateAttributes from './validateAttributes.js';
 import waitForAccess from './waitForAccess.js';
@@ -22,7 +23,7 @@ let FileEntry = class FileEntry {
         if (typeof callback === 'function') {
             try {
                 const normalizedPath = path.normalize(this.path);
-                const fullPath = path.join(dest, stripPath(normalizedPath, options));
+                const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));
                 const queue = new Queue(1);
                 if (options.force) {
                     queue.defer((callback)=>{

package/dist/esm/FileEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/FileEntry.ts"],"sourcesContent":["import { rm } from 'fs-remove-compat';\nimport fs from 'graceful-fs';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, FileAttributes, NoParamCallback, WriteFileFn } from './types.ts';\n\ninterface AbstractFileEntry {\n  _writeFile: WriteFileFn;\n}\n\nexport default class FileEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: FileAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'file';\n    if ((this as unknown as AbstractFileEntry)._writeFile === undefined) throw new Error('File this missing _writeFile. Please implement this method in your subclass');\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        } else {\n          // Check if file exists - throw EEXIST if it does\n          queue.defer((callback) => {\n            fs.stat(fullPath, (err) => {\n              if (!err) {\n                const existsErr = new Error(`EEXIST: file already exists, open '${fullPath}'`) as NodeJS.ErrnoException;\n                existsErr.code = 'EEXIST';\n                existsErr.path = fullPath;\n                return callback(existsErr);\n              }\n              // ENOENT means file doesn't exist - that's what we want\n              if (err.code === 'ENOENT') return callback();\n              // Other errors should be reported\n              callback(err);\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer((this as unknown as AbstractFileEntry)._writeFile.bind(this, fullPath, options));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["rm","fs","mkdirp","path","Queue","chmod","chown","utimes","objectAssign","stripPath","validateAttributes","waitForAccess","MANDATORY_ATTRIBUTES","FileEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","join","queue","force","defer","err","code","stat","existsErr","Error","bind","dirname","_writeFile","await","Promise","resolve","reject","done","destroy","attributes","basename","undefined","type"],"mappings":"AAAA,SAASA,EAAE,QAAQ,mBAAmB;AACtC,OAAOC,QAAQ,cAAc;AAC7B,OAAOC,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,YAAY,iBAAiB;AACpC,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AASvC,IAAA,AAAMC,YAAN,MAAMA;IAkBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBf,KAAKgB,SAAS,CAAC,IAAI,CAAChB,IAAI;gBAC/C,MAAMiB,WAAWjB,KAAKkB,IAAI,CAACN,MAAMN,UAAUS,gBAAgBF;gBAE3D,MAAMM,QAAQ,IAAIlB,MAAM;gBACxB,IAAIY,QAAQO,KAAK,EAAE;oBACjBD,MAAME,KAAK,CAAC,CAACP;wBACXjB,GAAGoB,UAAU,CAACK;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWT,SAASQ,OAAOR;wBACjD;oBACF;gBACF,OAAO;oBACL,iDAAiD;oBACjDK,MAAME,KAAK,CAAC,CAACP;wBACXhB,GAAG0B,IAAI,CAACP,UAAU,CAACK;4BACjB,IAAI,CAACA,KAAK;gCACR,MAAMG,YAAY,IAAIC,MAAM,CAAC,mCAAmC,EAAET,SAAS,CAAC,CAAC;gCAC7EQ,UAAUF,IAAI,GAAG;gCACjBE,UAAUzB,IAAI,GAAGiB;gCACjB,OAAOH,SAASW;4BAClB;4BACA,wDAAwD;4BACxD,IAAIH,IAAIC,IAAI,KAAK,UAAU,OAAOT;4BAClC,kCAAkC;4BAClCA,SAASQ;wBACX;oBACF;gBACF;gBACAH,MAAME,KAAK,CAACtB,OAAO4B,IAAI,CAAC,MAAM3B,KAAK4B,OAAO,CAACX;gBAC3CE,MAAME,KAAK,CAAC,AAAC,IAAI,CAAkCQ,UAAU,CAACF,IAAI,CAAC,IAAI,EAAEV,UAAUJ;gBACnFM,MAAME,KAAK,CAACb,cAAcmB,IAAI,CAAC,MAAMV;gBACrCE,MAAME,KAAK,CAACnB,MAAMyB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC7CM,MAAME,KAAK,CAAClB,MAAMwB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC7CM,MAAME,KAAK,CAACjB,OAAOuB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC9CM,MAAMW,KAAK,CAAChB;YACd,EAAE,OAAOQ,KAAK;gBACZR,SAASQ;YACX;YACA;QACF;QAEA,OAAO,IAAIS,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACtB,MAAM,CAACC,MAAMC,SAAS,CAACS,KAAaY,OAAoBZ,MAAMW,OAAOX,OAAOU,QAAQE;IACnI;IAEAC,UAAU,CAAC;IA5DX,YAAYC,UAA0B,CAAE;QACtC7B,mBAAmB6B,YAAY3B;QAC/BJ,aAAa,IAAI,EAAE+B;QACnB,IAAI,IAAI,CAACC,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGrC,KAAKqC,QAAQ,CAAC,IAAI,CAACrC,IAAI;QACxE,IAAI,IAAI,CAACuC,IAAI,KAAKD,WAAW,IAAI,CAACC,IAAI,GAAG;QACzC,IAAI,AAAC,IAAI,CAAkCV,UAAU,KAAKS,WAAW,MAAM,IAAIZ,MAAM;IACvF;AAuDF;AApEA,SAAqBhB,uBAoEpB"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/FileEntry.ts"],"sourcesContent":["import { rm } from 'fs-remove-compat';\nimport fs from 'graceful-fs';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, FileAttributes, NoParamCallback, WriteFileFn } from './types.ts';\n\ninterface AbstractFileEntry {\n  _writeFile: WriteFileFn;\n}\n\nexport default class FileEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: FileAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'file';\n    if ((this as unknown as AbstractFileEntry)._writeFile === undefined) throw new Error('File this missing _writeFile. Please implement this method in your subclass');\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        } else {\n          // Check if file exists - throw EEXIST if it does\n          queue.defer((callback) => {\n            fs.stat(fullPath, (err) => {\n              if (!err) {\n                const existsErr = new Error(`EEXIST: file already exists, open '${fullPath}'`) as NodeJS.ErrnoException;\n                existsErr.code = 'EEXIST';\n                existsErr.path = fullPath;\n                return callback(existsErr);\n              }\n              // ENOENT means file doesn't exist - that's what we want\n              if (err.code === 'ENOENT') return callback();\n              // Other errors should be reported\n              callback(err);\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer((this as unknown as AbstractFileEntry)._writeFile.bind(this, fullPath, options));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["rm","fs","mkdirp","path","Queue","chmod","chown","utimes","objectAssign","safeJoinPath","stripPath","validateAttributes","waitForAccess","MANDATORY_ATTRIBUTES","FileEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","queue","force","defer","err","code","stat","existsErr","Error","bind","dirname","_writeFile","await","Promise","resolve","reject","done","destroy","attributes","basename","undefined","type"],"mappings":"AAAA,SAASA,EAAE,QAAQ,mBAAmB;AACtC,OAAOC,QAAQ,cAAc;AAC7B,OAAOC,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,YAAY,iBAAiB;AACpC,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,kBAAkB,2BAA2B;AACpD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;CAAO;AASvC,IAAA,AAAMC,YAAN,MAAMA;IAkBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBhB,KAAKiB,SAAS,CAAC,IAAI,CAACjB,IAAI;gBAC/C,MAAMkB,WAAWZ,aAAaO,MAAMN,UAAUS,gBAAgBF;gBAE9D,MAAMK,QAAQ,IAAIlB,MAAM;gBACxB,IAAIa,QAAQM,KAAK,EAAE;oBACjBD,MAAME,KAAK,CAAC,CAACN;wBACXlB,GAAGqB,UAAU,CAACI;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWR,SAASO,OAAOP;wBACjD;oBACF;gBACF,OAAO;oBACL,iDAAiD;oBACjDI,MAAME,KAAK,CAAC,CAACN;wBACXjB,GAAG0B,IAAI,CAACN,UAAU,CAACI;4BACjB,IAAI,CAACA,KAAK;gCACR,MAAMG,YAAY,IAAIC,MAAM,CAAC,mCAAmC,EAAER,SAAS,CAAC,CAAC;gCAC7EO,UAAUF,IAAI,GAAG;gCACjBE,UAAUzB,IAAI,GAAGkB;gCACjB,OAAOH,SAASU;4BAClB;4BACA,wDAAwD;4BACxD,IAAIH,IAAIC,IAAI,KAAK,UAAU,OAAOR;4BAClC,kCAAkC;4BAClCA,SAASO;wBACX;oBACF;gBACF;gBACAH,MAAME,KAAK,CAACtB,OAAO4B,IAAI,CAAC,MAAM3B,KAAK4B,OAAO,CAACV;gBAC3CC,MAAME,KAAK,CAAC,AAAC,IAAI,CAAkCQ,UAAU,CAACF,IAAI,CAAC,IAAI,EAAET,UAAUJ;gBACnFK,MAAME,KAAK,CAACZ,cAAckB,IAAI,CAAC,MAAMT;gBACrCC,MAAME,KAAK,CAACnB,MAAMyB,IAAI,CAAC,MAAMT,UAAU,IAAI,EAAEJ;gBAC7CK,MAAME,KAAK,CAAClB,MAAMwB,IAAI,CAAC,MAAMT,UAAU,IAAI,EAAEJ;gBAC7CK,MAAME,KAAK,CAACjB,OAAOuB,IAAI,CAAC,MAAMT,UAAU,IAAI,EAAEJ;gBAC9CK,MAAMW,KAAK,CAACf;YACd,EAAE,OAAOO,KAAK;gBACZP,SAASO;YACX;YACA;QACF;QAEA,OAAO,IAAIS,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACrB,MAAM,CAACC,MAAMC,SAAS,CAACQ,KAAaY,OAAoBZ,MAAMW,OAAOX,OAAOU,QAAQE;IACnI;IAEAC,UAAU,CAAC;IA5DX,YAAYC,UAA0B,CAAE;QACtC5B,mBAAmB4B,YAAY1B;QAC/BL,aAAa,IAAI,EAAE+B;QACnB,IAAI,IAAI,CAACC,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGrC,KAAKqC,QAAQ,CAAC,IAAI,CAACrC,IAAI;QACxE,IAAI,IAAI,CAACuC,IAAI,KAAKD,WAAW,IAAI,CAACC,IAAI,GAAG;QACzC,IAAI,AAAC,IAAI,CAAkCV,UAAU,KAAKS,WAAW,MAAM,IAAIZ,MAAM;IACvF;AAuDF;AApEA,SAAqBf,uBAoEpB"}

package/dist/esm/LinkEntry.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import { rm } from 'fs-remove-compat';
+import isAbsolute from 'is-absolute';
 import mkdirp from 'mkdirp-classic';
 import path from 'path';
 import Queue from 'queue-cb';
@@ -7,6 +8,7 @@ import chmod from './fs/chmod.js';
 import chown from './fs/chown.js';
 import utimes from './fs/utimes.js';
 import { objectAssign } from './shared/index.js';
+import safeJoinPath from './shared/safeJoinPath.js';
 import stripPath from './shared/stripPath.js';
 import validateAttributes from './validateAttributes.js';
 import waitForAccess from './waitForAccess.js';
@@ -23,9 +25,14 @@ let LinkEntry = class LinkEntry {
         if (typeof callback === 'function') {
             try {
                 const normalizedPath = path.normalize(this.path);
-                const fullPath = path.join(dest, stripPath(normalizedPath, options));
+                const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));
+                if (isAbsolute(this.linkpath)) {
+                    const err = new Error(`Absolute linkpath rejected: '${this.linkpath}'`);
+                    err.code = 'ETRAVERSAL';
+                    throw err;
+                }
                 const normalizedLinkpath = path.normalize(this.linkpath);
-                const linkFullPath = path.join(dest, stripPath(normalizedLinkpath, options));
+                const linkFullPath = safeJoinPath(dest, stripPath(normalizedLinkpath, options));
                 const queue = new Queue(1);
                 if (options.force) {
                     queue.defer((callback)=>{

package/dist/esm/LinkEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/LinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class LinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'link';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n        const normalizedLinkpath = path.normalize(this.linkpath);\n        const linkFullPath = path.join(dest, stripPath(normalizedLinkpath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer(waitForAccess.bind(null, linkFullPath)); // ensure target file is accessible before linking\n        queue.defer(fs.link.bind(fs, linkFullPath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["fs","rm","mkdirp","path","Queue","chmod","chown","utimes","objectAssign","stripPath","validateAttributes","waitForAccess","MANDATORY_ATTRIBUTES","LinkEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","join","normalizedLinkpath","linkpath","linkFullPath","queue","force","defer","err","code","bind","dirname","link","await","Promise","resolve","reject","done","destroy","attributes","basename","undefined","type"],"mappings":"AAAA,OAAOA,QAAQ,KAAK;AACpB,SAASC,EAAE,QAAQ,mBAAmB;AACtC,OAAOC,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,YAAY,iBAAiB;AACpC,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMC,YAAN,MAAMA;IAkBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBf,KAAKgB,SAAS,CAAC,IAAI,CAAChB,IAAI;gBAC/C,MAAMiB,WAAWjB,KAAKkB,IAAI,CAACN,MAAMN,UAAUS,gBAAgBF;gBAC3D,MAAMM,qBAAqBnB,KAAKgB,SAAS,CAAC,IAAI,CAACI,QAAQ;gBACvD,MAAMC,eAAerB,KAAKkB,IAAI,CAACN,MAAMN,UAAUa,oBAAoBN;gBAEnE,MAAMS,QAAQ,IAAIrB,MAAM;gBACxB,IAAIY,QAAQU,KAAK,EAAE;oBACjBD,MAAME,KAAK,CAAC,CAACV;wBACXhB,GAAGmB,UAAU,CAACQ;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWZ,SAASW,OAAOX;wBACjD;oBACF;gBACF;gBACAQ,MAAME,KAAK,CAACzB,OAAO4B,IAAI,CAAC,MAAM3B,KAAK4B,OAAO,CAACX;gBAC3CK,MAAME,KAAK,CAAChB,cAAcmB,IAAI,CAAC,MAAMN,gBAAgB,kDAAkD;gBACvGC,MAAME,KAAK,CAAC3B,GAAGgC,IAAI,CAACF,IAAI,CAAC9B,IAAIwB,cAAcJ;gBAC3CK,MAAME,KAAK,CAAChB,cAAcmB,IAAI,CAAC,MAAMV;gBACrCK,MAAME,KAAK,CAACtB,MAAMyB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC7CS,MAAME,KAAK,CAACrB,MAAMwB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC7CS,MAAME,KAAK,CAACpB,OAAOuB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC9CS,MAAMQ,KAAK,CAAChB;YACd,EAAE,OAAOW,KAAK;gBACZX,SAASW;YACX;YACA;QACF;QAEA,OAAO,IAAIM,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACtB,MAAM,CAACC,MAAMC,SAAS,CAACY,KAAaS,OAAoBT,MAAMQ,OAAOR,OAAOO,QAAQE;IACnI;IAEAC,UAAU,CAAC;IA9CX,YAAYC,UAA0B,CAAE;QACtC7B,mBAAmB6B,YAAY3B;QAC/BJ,aAAa,IAAI,EAAE+B;QACnB,IAAI,IAAI,CAACC,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGrC,KAAKqC,QAAQ,CAAC,IAAI,CAACrC,IAAI;QACxE,IAAI,IAAI,CAACuC,IAAI,KAAKD,WAAW,IAAI,CAACC,IAAI,GAAG;IAC3C;AA0CF;AAvDA,SAAqB7B,uBAuDpB"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/LinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport isAbsolute from 'is-absolute';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport utimes from './fs/utimes.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class LinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'link';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n        if (isAbsolute(this.linkpath)) {\n          const err = new Error(`Absolute linkpath rejected: '${this.linkpath}'`) as NodeJS.ErrnoException;\n          err.code = 'ETRAVERSAL';\n          throw err;\n        }\n        const normalizedLinkpath = path.normalize(this.linkpath);\n        const linkFullPath = safeJoinPath(dest, stripPath(normalizedLinkpath, options));\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        queue.defer(waitForAccess.bind(null, linkFullPath)); // ensure target file is accessible before linking\n        queue.defer(fs.link.bind(fs, linkFullPath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath));\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(utimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["fs","rm","isAbsolute","mkdirp","path","Queue","chmod","chown","utimes","objectAssign","safeJoinPath","stripPath","validateAttributes","waitForAccess","MANDATORY_ATTRIBUTES","LinkEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","linkpath","err","Error","code","normalizedLinkpath","linkFullPath","queue","force","defer","bind","dirname","link","await","Promise","resolve","reject","done","destroy","attributes","basename","undefined","type"],"mappings":"AAAA,OAAOA,QAAQ,KAAK;AACpB,SAASC,EAAE,QAAQ,mBAAmB;AACtC,OAAOC,gBAAgB,cAAc;AACrC,OAAOC,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,YAAY,iBAAiB;AACpC,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,kBAAkB,2BAA2B;AACpD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMC,YAAN,MAAMA;IAkBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBhB,KAAKiB,SAAS,CAAC,IAAI,CAACjB,IAAI;gBAC/C,MAAMkB,WAAWZ,aAAaO,MAAMN,UAAUS,gBAAgBF;gBAC9D,IAAIhB,WAAW,IAAI,CAACqB,QAAQ,GAAG;oBAC7B,MAAMC,MAAM,IAAIC,MAAM,CAAC,6BAA6B,EAAE,IAAI,CAACF,QAAQ,CAAC,CAAC,CAAC;oBACtEC,IAAIE,IAAI,GAAG;oBACX,MAAMF;gBACR;gBACA,MAAMG,qBAAqBvB,KAAKiB,SAAS,CAAC,IAAI,CAACE,QAAQ;gBACvD,MAAMK,eAAelB,aAAaO,MAAMN,UAAUgB,oBAAoBT;gBAEtE,MAAMW,QAAQ,IAAIxB,MAAM;gBACxB,IAAIa,QAAQY,KAAK,EAAE;oBACjBD,MAAME,KAAK,CAAC,CAACZ;wBACXlB,GAAGqB,UAAU,CAACE;4BACZA,OAAOA,IAAIE,IAAI,KAAK,WAAWP,SAASK,OAAOL;wBACjD;oBACF;gBACF;gBACAU,MAAME,KAAK,CAAC5B,OAAO6B,IAAI,CAAC,MAAM5B,KAAK6B,OAAO,CAACX;gBAC3CO,MAAME,KAAK,CAAClB,cAAcmB,IAAI,CAAC,MAAMJ,gBAAgB,kDAAkD;gBACvGC,MAAME,KAAK,CAAC/B,GAAGkC,IAAI,CAACF,IAAI,CAAChC,IAAI4B,cAAcN;gBAC3CO,MAAME,KAAK,CAAClB,cAAcmB,IAAI,CAAC,MAAMV;gBACrCO,MAAME,KAAK,CAACzB,MAAM0B,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC7CW,MAAME,KAAK,CAACxB,MAAMyB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC7CW,MAAME,KAAK,CAACvB,OAAOwB,IAAI,CAAC,MAAMV,UAAU,IAAI,EAAEJ;gBAC9CW,MAAMM,KAAK,CAAChB;YACd,EAAE,OAAOK,KAAK;gBACZL,SAASK;YACX;YACA;QACF;QAEA,OAAO,IAAIY,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACtB,MAAM,CAACC,MAAMC,SAAS,CAACM,KAAae,OAAoBf,MAAMc,OAAOd,OAAOa,QAAQE;IACnI;IAEAC,UAAU,CAAC;IAnDX,YAAYC,UAA0B,CAAE;QACtC7B,mBAAmB6B,YAAY3B;QAC/BL,aAAa,IAAI,EAAEgC;QACnB,IAAI,IAAI,CAACC,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAGtC,KAAKsC,QAAQ,CAAC,IAAI,CAACtC,IAAI;QACxE,IAAI,IAAI,CAACwC,IAAI,KAAKD,WAAW,IAAI,CAACC,IAAI,GAAG;IAC3C;AA+CF;AA5DA,SAAqB7B,uBA4DpB"}

package/dist/esm/SymbolicLinkEntry.js

@@ -9,6 +9,7 @@ import chown from './fs/chown.js';
 import lutimes from './fs/lutimes.js';
 import symlinkWin32 from './fs/symlinkWin32.js';
 import { objectAssign } from './shared/index.js';
+import safeJoinPath from './shared/safeJoinPath.js';
 import stripPath from './shared/stripPath.js';
 import validateAttributes from './validateAttributes.js';
 import waitForAccess from './waitForAccess.js';
@@ -26,14 +27,18 @@ let SymbolicLinkEntry = class SymbolicLinkEntry {
         if (typeof callback === 'function') {
             try {
                 const normalizedPath = path.normalize(this.path);
-                const fullPath = path.join(dest, stripPath(normalizedPath, options));
-                let normalizedLinkpath = path.normalize(this.linkpath);
-                let linkFullPath = path.join(dest, stripPath(normalizedLinkpath, options));
-                if (!isAbsolute(normalizedLinkpath)) {
-                    const linkRelativePath = path.join(path.dirname(normalizedPath), this.linkpath);
-                    linkFullPath = path.join(dest, stripPath(linkRelativePath, options));
-                    normalizedLinkpath = path.relative(path.dirname(fullPath), linkFullPath);
+                const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));
+                if (isAbsolute(this.linkpath)) {
+                    const err = new Error(`Absolute linkpath rejected: '${this.linkpath}'`);
+                    err.code = 'ETRAVERSAL';
+                    throw err;
                 }
+                // Resolve the symlink target against the symlink's own directory and verify it
+                // stays within dest. safeJoinPath throws ETRAVERSAL if it escapes.
+                const targetAbs = path.resolve(path.dirname(fullPath), this.linkpath);
+                safeJoinPath(dest, path.relative(dest, targetAbs));
+                const normalizedLinkpath = path.relative(path.dirname(fullPath), targetAbs);
+                const linkFullPath = targetAbs;
                 const queue = new Queue(1);
                 if (options.force) {
                     queue.defer((callback)=>{

package/dist/esm/SymbolicLinkEntry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/SymbolicLinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport isAbsolute from 'is-absolute';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport lutimes from './fs/lutimes.ts';\nimport symlinkWin32 from './fs/symlinkWin32.ts';\nimport { objectAssign } from './shared/index.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst isWindows = process.platform === 'win32' || /^(msys|cygwin)$/.test(process.env.OSTYPE);\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class SymbolicLinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'symlink';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = path.join(dest, stripPath(normalizedPath, options));\n        let normalizedLinkpath = path.normalize(this.linkpath);\n        let linkFullPath = path.join(dest, stripPath(normalizedLinkpath, options));\n        if (!isAbsolute(normalizedLinkpath)) {\n          const linkRelativePath = path.join(path.dirname(normalizedPath), this.linkpath);\n          linkFullPath = path.join(dest, stripPath(linkRelativePath, options));\n          normalizedLinkpath = path.relative(path.dirname(fullPath), linkFullPath);\n        }\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        if (isWindows) queue.defer(symlinkWin32.bind(null, linkFullPath, normalizedLinkpath, fullPath));\n        else queue.defer(fs.symlink.bind(fs, normalizedLinkpath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath, true)); // noFollow=true for symlinks\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(lutimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["fs","rm","isAbsolute","mkdirp","path","Queue","chmod","chown","lutimes","symlinkWin32","objectAssign","stripPath","validateAttributes","waitForAccess","isWindows","process","platform","test","env","OSTYPE","MANDATORY_ATTRIBUTES","SymbolicLinkEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","join","normalizedLinkpath","linkpath","linkFullPath","linkRelativePath","dirname","relative","queue","force","defer","err","code","bind","symlink","await","Promise","resolve","reject","done","destroy","attributes","basename","undefined","type"],"mappings":"AAAA,OAAOA,QAAQ,KAAK;AACpB,SAASC,EAAE,QAAQ,mBAAmB;AACtC,OAAOC,gBAAgB,cAAc;AACrC,OAAOC,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,aAAa,kBAAkB;AACtC,OAAOC,kBAAkB,uBAAuB;AAChD,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,YAAYC,QAAQC,QAAQ,KAAK,WAAW,kBAAkBC,IAAI,CAACF,QAAQG,GAAG,CAACC,MAAM;AAE3F,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMC,oBAAN,MAAMA;IAkBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBtB,KAAKuB,SAAS,CAAC,IAAI,CAACvB,IAAI;gBAC/C,MAAMwB,WAAWxB,KAAKyB,IAAI,CAACN,MAAMZ,UAAUe,gBAAgBF;gBAC3D,IAAIM,qBAAqB1B,KAAKuB,SAAS,CAAC,IAAI,CAACI,QAAQ;gBACrD,IAAIC,eAAe5B,KAAKyB,IAAI,CAACN,MAAMZ,UAAUmB,oBAAoBN;gBACjE,IAAI,CAACtB,WAAW4B,qBAAqB;oBACnC,MAAMG,mBAAmB7B,KAAKyB,IAAI,CAACzB,KAAK8B,OAAO,CAACR,iBAAiB,IAAI,CAACK,QAAQ;oBAC9EC,eAAe5B,KAAKyB,IAAI,CAACN,MAAMZ,UAAUsB,kBAAkBT;oBAC3DM,qBAAqB1B,KAAK+B,QAAQ,CAAC/B,KAAK8B,OAAO,CAACN,WAAWI;gBAC7D;gBAEA,MAAMI,QAAQ,IAAI/B,MAAM;gBACxB,IAAImB,QAAQa,KAAK,EAAE;oBACjBD,MAAME,KAAK,CAAC,CAACb;wBACXxB,GAAG2B,UAAU,CAACW;4BACZA,OAAOA,IAAIC,IAAI,KAAK,WAAWf,SAASc,OAAOd;wBACjD;oBACF;gBACF;gBACAW,MAAME,KAAK,CAACnC,OAAOsC,IAAI,CAAC,MAAMrC,KAAK8B,OAAO,CAACN;gBAC3C,IAAId,WAAWsB,MAAME,KAAK,CAAC7B,aAAagC,IAAI,CAAC,MAAMT,cAAcF,oBAAoBF;qBAChFQ,MAAME,KAAK,CAACtC,GAAG0C,OAAO,CAACD,IAAI,CAACzC,IAAI8B,oBAAoBF;gBACzDQ,MAAME,KAAK,CAACzB,cAAc4B,IAAI,CAAC,MAAMb,UAAU,QAAQ,6BAA6B;gBACpFQ,MAAME,KAAK,CAAChC,MAAMmC,IAAI,CAAC,MAAMb,UAAU,IAAI,EAAEJ;gBAC7CY,MAAME,KAAK,CAAC/B,MAAMkC,IAAI,CAAC,MAAMb,UAAU,IAAI,EAAEJ;gBAC7CY,MAAME,KAAK,CAAC9B,QAAQiC,IAAI,CAAC,MAAMb,UAAU,IAAI,EAAEJ;gBAC/CY,MAAMO,KAAK,CAAClB;YACd,EAAE,OAAOc,KAAK;gBACZd,SAASc;YACX;YACA;QACF;QAEA,OAAO,IAAIK,QAAQ,CAACC,SAASC,SAAW,IAAI,CAACxB,MAAM,CAACC,MAAMC,SAAS,CAACe,KAAaQ,OAAoBR,MAAMO,OAAOP,OAAOM,QAAQE;IACnI;IAEAC,UAAU,CAAC;IAnDX,YAAYC,UAA0B,CAAE;QACtCrC,mBAAmBqC,YAAY7B;QAC/BV,aAAa,IAAI,EAAEuC;QACnB,IAAI,IAAI,CAACC,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAG9C,KAAK8C,QAAQ,CAAC,IAAI,CAAC9C,IAAI;QACxE,IAAI,IAAI,CAACgD,IAAI,KAAKD,WAAW,IAAI,CAACC,IAAI,GAAG;IAC3C;AA+CF;AA5DA,SAAqB/B,+BA4DpB"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/SymbolicLinkEntry.ts"],"sourcesContent":["import fs from 'fs';\nimport { rm } from 'fs-remove-compat';\nimport isAbsolute from 'is-absolute';\nimport mkdirp from 'mkdirp-classic';\nimport path from 'path';\nimport Queue from 'queue-cb';\nimport chmod from './fs/chmod.ts';\nimport chown from './fs/chown.ts';\nimport lutimes from './fs/lutimes.ts';\nimport symlinkWin32 from './fs/symlinkWin32.ts';\nimport { objectAssign } from './shared/index.ts';\nimport safeJoinPath from './shared/safeJoinPath.ts';\nimport stripPath from './shared/stripPath.ts';\nimport validateAttributes from './validateAttributes.ts';\nimport waitForAccess from './waitForAccess.ts';\n\nconst isWindows = process.platform === 'win32' || /^(msys|cygwin)$/.test(process.env.OSTYPE);\n\nconst MANDATORY_ATTRIBUTES = ['mode', 'mtime', 'path', 'linkpath'];\n\nimport type { Mode } from 'fs';\nimport type { ExtractOptions, LinkAttributes, NoParamCallback } from './types.ts';\n\nexport default class SymbolicLinkEntry {\n  mode: Mode;\n  mtime: number;\n  path: string;\n  linkpath: string;\n  basename: string;\n  type: string;\n\n  constructor(attributes: LinkAttributes) {\n    validateAttributes(attributes, MANDATORY_ATTRIBUTES);\n    objectAssign(this, attributes);\n    if (this.basename === undefined) this.basename = path.basename(this.path);\n    if (this.type === undefined) this.type = 'symlink';\n  }\n\n  create(dest: string, callback: NoParamCallback): void;\n  create(dest: string, options: ExtractOptions, callback: NoParamCallback): void;\n  create(dest: string, options?: ExtractOptions): Promise<boolean>;\n  create(dest: string, options?: ExtractOptions | NoParamCallback, callback?: NoParamCallback): void | Promise<boolean> {\n    callback = typeof options === 'function' ? options : callback;\n    options = typeof options === 'function' ? {} : ((options || {}) as ExtractOptions);\n\n    if (typeof callback === 'function') {\n      try {\n        const normalizedPath = path.normalize(this.path);\n        const fullPath = safeJoinPath(dest, stripPath(normalizedPath, options));\n\n        if (isAbsolute(this.linkpath)) {\n          const err = new Error(`Absolute linkpath rejected: '${this.linkpath}'`) as NodeJS.ErrnoException;\n          err.code = 'ETRAVERSAL';\n          throw err;\n        }\n        // Resolve the symlink target against the symlink's own directory and verify it\n        // stays within dest. safeJoinPath throws ETRAVERSAL if it escapes.\n        const targetAbs = path.resolve(path.dirname(fullPath), this.linkpath);\n        safeJoinPath(dest, path.relative(dest, targetAbs));\n        const normalizedLinkpath = path.relative(path.dirname(fullPath), targetAbs);\n        const linkFullPath = targetAbs;\n\n        const queue = new Queue(1);\n        if (options.force) {\n          queue.defer((callback) => {\n            rm(fullPath, (err) => {\n              err && err.code !== 'ENOENT' ? callback(err) : callback();\n            });\n          });\n        }\n        queue.defer(mkdirp.bind(null, path.dirname(fullPath)));\n        if (isWindows) queue.defer(symlinkWin32.bind(null, linkFullPath, normalizedLinkpath, fullPath));\n        else queue.defer(fs.symlink.bind(fs, normalizedLinkpath, fullPath));\n        queue.defer(waitForAccess.bind(null, fullPath, true)); // noFollow=true for symlinks\n        queue.defer(chmod.bind(null, fullPath, this, options));\n        queue.defer(chown.bind(null, fullPath, this, options));\n        queue.defer(lutimes.bind(null, fullPath, this, options));\n        queue.await(callback);\n      } catch (err) {\n        callback(err);\n      }\n      return;\n    }\n\n    return new Promise((resolve, reject) => this.create(dest, options, (err?: Error, done?: boolean) => (err ? reject(err) : resolve(done))));\n  }\n\n  destroy() {}\n}\n"],"names":["fs","rm","isAbsolute","mkdirp","path","Queue","chmod","chown","lutimes","symlinkWin32","objectAssign","safeJoinPath","stripPath","validateAttributes","waitForAccess","isWindows","process","platform","test","env","OSTYPE","MANDATORY_ATTRIBUTES","SymbolicLinkEntry","create","dest","options","callback","normalizedPath","normalize","fullPath","linkpath","err","Error","code","targetAbs","resolve","dirname","relative","normalizedLinkpath","linkFullPath","queue","force","defer","bind","symlink","await","Promise","reject","done","destroy","attributes","basename","undefined","type"],"mappings":"AAAA,OAAOA,QAAQ,KAAK;AACpB,SAASC,EAAE,QAAQ,mBAAmB;AACtC,OAAOC,gBAAgB,cAAc;AACrC,OAAOC,YAAY,iBAAiB;AACpC,OAAOC,UAAU,OAAO;AACxB,OAAOC,WAAW,WAAW;AAC7B,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,WAAW,gBAAgB;AAClC,OAAOC,aAAa,kBAAkB;AACtC,OAAOC,kBAAkB,uBAAuB;AAChD,SAASC,YAAY,QAAQ,oBAAoB;AACjD,OAAOC,kBAAkB,2BAA2B;AACpD,OAAOC,eAAe,wBAAwB;AAC9C,OAAOC,wBAAwB,0BAA0B;AACzD,OAAOC,mBAAmB,qBAAqB;AAE/C,MAAMC,YAAYC,QAAQC,QAAQ,KAAK,WAAW,kBAAkBC,IAAI,CAACF,QAAQG,GAAG,CAACC,MAAM;AAE3F,MAAMC,uBAAuB;IAAC;IAAQ;IAAS;IAAQ;CAAW;AAKnD,IAAA,AAAMC,oBAAN,MAAMA;IAkBnBC,OAAOC,IAAY,EAAEC,OAA0C,EAAEC,QAA0B,EAA2B;QACpHA,WAAW,OAAOD,YAAY,aAAaA,UAAUC;QACrDD,UAAU,OAAOA,YAAY,aAAa,CAAC,IAAMA,WAAW,CAAC;QAE7D,IAAI,OAAOC,aAAa,YAAY;YAClC,IAAI;gBACF,MAAMC,iBAAiBvB,KAAKwB,SAAS,CAAC,IAAI,CAACxB,IAAI;gBAC/C,MAAMyB,WAAWlB,aAAaa,MAAMZ,UAAUe,gBAAgBF;gBAE9D,IAAIvB,WAAW,IAAI,CAAC4B,QAAQ,GAAG;oBAC7B,MAAMC,MAAM,IAAIC,MAAM,CAAC,6BAA6B,EAAE,IAAI,CAACF,QAAQ,CAAC,CAAC,CAAC;oBACtEC,IAAIE,IAAI,GAAG;oBACX,MAAMF;gBACR;gBACA,+EAA+E;gBAC/E,mEAAmE;gBACnE,MAAMG,YAAY9B,KAAK+B,OAAO,CAAC/B,KAAKgC,OAAO,CAACP,WAAW,IAAI,CAACC,QAAQ;gBACpEnB,aAAaa,MAAMpB,KAAKiC,QAAQ,CAACb,MAAMU;gBACvC,MAAMI,qBAAqBlC,KAAKiC,QAAQ,CAACjC,KAAKgC,OAAO,CAACP,WAAWK;gBACjE,MAAMK,eAAeL;gBAErB,MAAMM,QAAQ,IAAInC,MAAM;gBACxB,IAAIoB,QAAQgB,KAAK,EAAE;oBACjBD,MAAME,KAAK,CAAC,CAAChB;wBACXzB,GAAG4B,UAAU,CAACE;4BACZA,OAAOA,IAAIE,IAAI,KAAK,WAAWP,SAASK,OAAOL;wBACjD;oBACF;gBACF;gBACAc,MAAME,KAAK,CAACvC,OAAOwC,IAAI,CAAC,MAAMvC,KAAKgC,OAAO,CAACP;gBAC3C,IAAId,WAAWyB,MAAME,KAAK,CAACjC,aAAakC,IAAI,CAAC,MAAMJ,cAAcD,oBAAoBT;qBAChFW,MAAME,KAAK,CAAC1C,GAAG4C,OAAO,CAACD,IAAI,CAAC3C,IAAIsC,oBAAoBT;gBACzDW,MAAME,KAAK,CAAC5B,cAAc6B,IAAI,CAAC,MAAMd,UAAU,QAAQ,6BAA6B;gBACpFW,MAAME,KAAK,CAACpC,MAAMqC,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7Ce,MAAME,KAAK,CAACnC,MAAMoC,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC7Ce,MAAME,KAAK,CAAClC,QAAQmC,IAAI,CAAC,MAAMd,UAAU,IAAI,EAAEJ;gBAC/Ce,MAAMK,KAAK,CAACnB;YACd,EAAE,OAAOK,KAAK;gBACZL,SAASK;YACX;YACA;QACF;QAEA,OAAO,IAAIe,QAAQ,CAACX,SAASY,SAAW,IAAI,CAACxB,MAAM,CAACC,MAAMC,SAAS,CAACM,KAAaiB,OAAoBjB,MAAMgB,OAAOhB,OAAOI,QAAQa;IACnI;IAEAC,UAAU,CAAC;IAxDX,YAAYC,UAA0B,CAAE;QACtCrC,mBAAmBqC,YAAY7B;QAC/BX,aAAa,IAAI,EAAEwC;QACnB,IAAI,IAAI,CAACC,QAAQ,KAAKC,WAAW,IAAI,CAACD,QAAQ,GAAG/C,KAAK+C,QAAQ,CAAC,IAAI,CAAC/C,IAAI;QACxE,IAAI,IAAI,CAACiD,IAAI,KAAKD,WAAW,IAAI,CAACC,IAAI,GAAG;IAC3C;AAoDF;AAjEA,SAAqB/B,+BAiEpB"}

package/dist/esm/shared/index.d.ts

@@ -22,5 +22,6 @@ export { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.js';
 export { default as EntryStream } from './EntryStream.js';
 export { type CleanupFn, default as Lock } from './Lock.js';
 export { default as normalizePath } from './normalizePath.js';
+export { default as safeJoinPath } from './safeJoinPath.js';
 export { default as streamToString, type StreamToStringCallback } from './streamToString.js';
 export { default as stripPath } from './stripPath.js';

package/dist/esm/shared/index.js

@@ -15,5 +15,6 @@ export { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.js';
 export { default as EntryStream } from './EntryStream.js';
 export { default as Lock } from './Lock.js';
 export { default as normalizePath } from './normalizePath.js';
+export { default as safeJoinPath } from './safeJoinPath.js';
 export { default as streamToString } from './streamToString.js';
 export { default as stripPath } from './stripPath.js';

package/dist/esm/shared/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/shared/index.ts"],"sourcesContent":["/**\n * Shared utilities for iterator libraries\n *\n * These utilities are designed to be used by:\n * - zip-iterator\n * - 7z-iterator\n * - tar-iterator\n * - Any other archive iterator library\n *\n * All utilities support Node.js 0.8+\n */\n\nimport BufferList from './BufferList.ts';\n\nexport { BufferList };\n\n/**\n * Type alias for Buffer or BufferList - both can be read byte-by-byte.\n * Use this when an API should accept either contiguous data (Buffer)\n * or chunked streaming data (BufferList).\n */\nexport type BufferLike = Buffer | BufferList;\nexport {\n  allocBuffer,\n  allocBufferUnsafe,\n  bufferCompare,\n  bufferConcat,\n  bufferEquals,\n  bufferFrom,\n  bufferSliceCopy,\n  canAllocateBufferSize,\n  createInflateRawStream,\n  inflateRaw,\n  isNaN,\n  MAX_SAFE_BUFFER_LENGTH,\n  objectAssign,\n  PassThrough,\n  Readable,\n  readUInt64LE,\n  Transform,\n  Writable,\n  writeUInt64LE,\n} from './compat.ts';\nexport { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.ts';\nexport { default as EntryStream } from './EntryStream.ts';\nexport { type CleanupFn, default as Lock } from './Lock.ts';\nexport { default as normalizePath } from './normalizePath.ts';\nexport { default as streamToString, type StreamToStringCallback } from './streamToString.ts';\nexport { default as stripPath } from './stripPath.ts';\n"],"names":["BufferList","allocBuffer","allocBufferUnsafe","bufferCompare","bufferConcat","bufferEquals","bufferFrom","bufferSliceCopy","canAllocateBufferSize","createInflateRawStream","inflateRaw","isNaN","MAX_SAFE_BUFFER_LENGTH","objectAssign","PassThrough","Readable","readUInt64LE","Transform","Writable","writeUInt64LE","crc32","crc32Region","verifyCrc32","verifyCrc32Region","default","EntryStream","Lock","normalizePath","streamToString","stripPath"],"mappings":"AAAA;;;;;;;;;;CAUC,GAED,OAAOA,gBAAgB,kBAAkB;AAEzC,SAASA,UAAU,GAAG;AAQtB,SACEC,WAAW,EACXC,iBAAiB,EACjBC,aAAa,EACbC,YAAY,EACZC,YAAY,EACZC,UAAU,EACVC,eAAe,EACfC,qBAAqB,EACrBC,sBAAsB,EACtBC,UAAU,EACVC,KAAK,EACLC,sBAAsB,EACtBC,YAAY,EACZC,WAAW,EACXC,QAAQ,EACRC,YAAY,EACZC,SAAS,EACTC,QAAQ,EACRC,aAAa,QACR,cAAc;AACrB,SAASC,KAAK,EAAEC,WAAW,EAAEC,WAAW,EAAEC,iBAAiB,QAAQ,aAAa;AAChF,SAASC,WAAWC,WAAW,QAAQ,mBAAmB;AAC1D,SAAyBD,WAAWE,IAAI,QAAQ,YAAY;AAC5D,SAASF,WAAWG,aAAa,QAAQ,qBAAqB;AAC9D,SAASH,WAAWI,cAAc,QAAqC,sBAAsB;AAC7F,SAASJ,WAAWK,SAAS,QAAQ,iBAAiB"}
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/shared/index.ts"],"sourcesContent":["/**\n * Shared utilities for iterator libraries\n *\n * These utilities are designed to be used by:\n * - zip-iterator\n * - 7z-iterator\n * - tar-iterator\n * - Any other archive iterator library\n *\n * All utilities support Node.js 0.8+\n */\n\nimport BufferList from './BufferList.ts';\n\nexport { BufferList };\n\n/**\n * Type alias for Buffer or BufferList - both can be read byte-by-byte.\n * Use this when an API should accept either contiguous data (Buffer)\n * or chunked streaming data (BufferList).\n */\nexport type BufferLike = Buffer | BufferList;\nexport {\n  allocBuffer,\n  allocBufferUnsafe,\n  bufferCompare,\n  bufferConcat,\n  bufferEquals,\n  bufferFrom,\n  bufferSliceCopy,\n  canAllocateBufferSize,\n  createInflateRawStream,\n  inflateRaw,\n  isNaN,\n  MAX_SAFE_BUFFER_LENGTH,\n  objectAssign,\n  PassThrough,\n  Readable,\n  readUInt64LE,\n  Transform,\n  Writable,\n  writeUInt64LE,\n} from './compat.ts';\nexport { crc32, crc32Region, verifyCrc32, verifyCrc32Region } from './crc32.ts';\nexport { default as EntryStream } from './EntryStream.ts';\nexport { type CleanupFn, default as Lock } from './Lock.ts';\nexport { default as normalizePath } from './normalizePath.ts';\nexport { default as safeJoinPath } from './safeJoinPath.ts';\nexport { default as streamToString, type StreamToStringCallback } from './streamToString.ts';\nexport { default as stripPath } from './stripPath.ts';\n"],"names":["BufferList","allocBuffer","allocBufferUnsafe","bufferCompare","bufferConcat","bufferEquals","bufferFrom","bufferSliceCopy","canAllocateBufferSize","createInflateRawStream","inflateRaw","isNaN","MAX_SAFE_BUFFER_LENGTH","objectAssign","PassThrough","Readable","readUInt64LE","Transform","Writable","writeUInt64LE","crc32","crc32Region","verifyCrc32","verifyCrc32Region","default","EntryStream","Lock","normalizePath","safeJoinPath","streamToString","stripPath"],"mappings":"AAAA;;;;;;;;;;CAUC,GAED,OAAOA,gBAAgB,kBAAkB;AAEzC,SAASA,UAAU,GAAG;AAQtB,SACEC,WAAW,EACXC,iBAAiB,EACjBC,aAAa,EACbC,YAAY,EACZC,YAAY,EACZC,UAAU,EACVC,eAAe,EACfC,qBAAqB,EACrBC,sBAAsB,EACtBC,UAAU,EACVC,KAAK,EACLC,sBAAsB,EACtBC,YAAY,EACZC,WAAW,EACXC,QAAQ,EACRC,YAAY,EACZC,SAAS,EACTC,QAAQ,EACRC,aAAa,QACR,cAAc;AACrB,SAASC,KAAK,EAAEC,WAAW,EAAEC,WAAW,EAAEC,iBAAiB,QAAQ,aAAa;AAChF,SAASC,WAAWC,WAAW,QAAQ,mBAAmB;AAC1D,SAAyBD,WAAWE,IAAI,QAAQ,YAAY;AAC5D,SAASF,WAAWG,aAAa,QAAQ,qBAAqB;AAC9D,SAASH,WAAWI,YAAY,QAAQ,oBAAoB;AAC5D,SAASJ,WAAWK,cAAc,QAAqC,sBAAsB;AAC7F,SAASL,WAAWM,SAAS,QAAQ,iBAAiB"}

package/dist/esm/shared/safeJoinPath.d.ts

@@ -0,0 +1 @@
+export default function safeJoinPath(dest: string, relPath: string): string;

package/dist/esm/shared/safeJoinPath.js

@@ -0,0 +1,11 @@
+import path from 'path';
+export default function safeJoinPath(dest, relPath) {
+    const resolvedDest = path.resolve(dest);
+    const resolvedFull = path.resolve(dest, relPath);
+    if (resolvedFull !== resolvedDest && !resolvedFull.startsWith(resolvedDest + path.sep)) {
+        const err = new Error(`Path traversal detected: '${relPath}' escapes destination '${dest}'`);
+        err.code = 'ETRAVERSAL';
+        throw err;
+    }
+    return resolvedFull;
+}

package/dist/esm/shared/safeJoinPath.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/OpenSource/iterators/extract-base-iterator/src/shared/safeJoinPath.ts"],"sourcesContent":["import path from 'path';\n\nexport default function safeJoinPath(dest: string, relPath: string): string {\n  const resolvedDest = path.resolve(dest);\n  const resolvedFull = path.resolve(dest, relPath);\n  if (resolvedFull !== resolvedDest && !resolvedFull.startsWith(resolvedDest + path.sep)) {\n    const err = new Error(`Path traversal detected: '${relPath}' escapes destination '${dest}'`) as NodeJS.ErrnoException;\n    err.code = 'ETRAVERSAL';\n    throw err;\n  }\n  return resolvedFull;\n}\n"],"names":["path","safeJoinPath","dest","relPath","resolvedDest","resolve","resolvedFull","startsWith","sep","err","Error","code"],"mappings":"AAAA,OAAOA,UAAU,OAAO;AAExB,eAAe,SAASC,aAAaC,IAAY,EAAEC,OAAe;IAChE,MAAMC,eAAeJ,KAAKK,OAAO,CAACH;IAClC,MAAMI,eAAeN,KAAKK,OAAO,CAACH,MAAMC;IACxC,IAAIG,iBAAiBF,gBAAgB,CAACE,aAAaC,UAAU,CAACH,eAAeJ,KAAKQ,GAAG,GAAG;QACtF,MAAMC,MAAM,IAAIC,MAAM,CAAC,0BAA0B,EAAEP,QAAQ,uBAAuB,EAAED,KAAK,CAAC,CAAC;QAC3FO,IAAIE,IAAI,GAAG;QACX,MAAMF;IACR;IACA,OAAOH;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "extract-base-iterator",
-  "version": "3.4.2",
+  "version": "3.4.3",
   "description": "Base iterator for extract iterators like tar-iterator and zip-iterator",
   "keywords": [
     "extract",