iterate-skill-installer 2.3.0 → 2.3.5

package/lib/installer.js

@@ -162,7 +162,11 @@ function parseChecksums(text) {
     if (!trimmed) continue;
     const parts = trimmed.split(/\s+/);
     if (parts.length >= 2) {
-      map.set(parts[1], parts[0]);
+      // Strip the GNU tar binary-mode marker ('*') so that both
+      // "HASH  filename" and "HASH *filename" formats match the target
+      // filename, consistent with scripts/install.py (name.lstrip('*')).
+      const name = parts[1].replace(/^\*/, '');
+      map.set(name, parts[0]);
     }
   }
   return map;
@@ -187,9 +191,32 @@ function runCommand(bin, args, options = {}) {
 }
 
 async function extractTarball(tarballPath, destDir) {
-  // Use the system tar command (available on macOS, Linux, and Windows 10+).
-  // Strip the top-level directory so files land directly in destDir.
-  await runCommand('tar', ['-xzf', tarballPath, '-C', destDir, '--strip-components=1']);
+  // Use the system tar command (available on macOS, Linux, and Windows 10+),
+  // but defend against path-traversal tarballs: before extracting we list the
+  // archive contents and refuse to extract any entry whose resolved path
+  // escapes destDir (e.g. a "../" prefix). This keeps the installer
+  // dependency-free while closing the theoretical escape vector.
+  const absoluteDest = path.resolve(destDir);
+  fs.mkdirSync(absoluteDest, { recursive: true });
+
+  // 1. List archive entries (no extraction yet).
+  const listing = await runCommand('tar', ['-tzf', tarballPath]);
+
+  // 2. Validate every entry stays inside destDir after stripping the single
+  //    top-level directory component (--strip-components=1).
+  const entries = listing.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  for (const entry of entries) {
+    const stripped = entry.split('/').slice(1).join('/');
+    const resolved = path.resolve(absoluteDest, stripped || entry);
+    if (resolved !== absoluteDest && !resolved.startsWith(absoluteDest + path.sep)) {
+      throw new InstallerError(
+        `Refusing to extract tarball: entry "${entry}" escapes destination directory.`,
+      );
+    }
+  }
+
+  // 3. Now extract safely — the content has been validated above.
+  await runCommand('tar', ['-xzf', tarballPath, '-C', absoluteDest, '--strip-components=1']);
 }
 
 function runPythonInstall(pythonBin, installScript, args, options = {}) {
@@ -487,4 +514,5 @@ module.exports = {
   InstallerError,
   resolveInstallMode,
   askYesNo,
+  parseChecksums,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iterate-skill-installer",
-  "version": "2.3.0",
+  "version": "2.3.5",
   "description": "One-command installer for iterate-skill across AI coding assistants",
   "main": "lib/installer.js",
   "bin": {

package/test/mode.test.js

@@ -1,14 +1,15 @@
 /**
  * Unit tests for resolveInstallMode() — the global vs project install-mode
- * decision in the npx installer. Uses node:assert so no extra test runner is
- * required; run via `npm test`.
+ * decision — and parseChecksums() — the SHA256SUMS.txt parser — in the npx
+ * installer. Uses node:assert so no extra test runner is required; run via
+ * `npm test`.
  */
 
 const assert = require('node:assert');
 const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
-const { resolveInstallMode } = require('../lib/installer');
+const { resolveInstallMode, parseChecksums } = require('../lib/installer');
 
 const originalCwd = process.cwd();
 const originalHome = os.homedir;
@@ -79,6 +80,23 @@ async function run() {
   });
 
   console.log('mode.test.js: all resolveInstallMode tests passed');
+
+  // parseChecksums: must strip the GNU tar binary-mode marker ('*') so both
+  // "HASH  name" and "HASH *name" formats resolve, matching the Python side.
+  const plain = parseChecksums('abc123  iterate-skill.tar.gz\n');
+  assert.strictEqual(plain.get('iterate-skill.tar.gz'), 'abc123', 'plain format should parse');
+
+  const starred = parseChecksums('def456 *iterate-skill.tar.gz\n');
+  assert.strictEqual(starred.get('iterate-skill.tar.gz'), 'def456', 'starred format should strip the * marker');
+
+  const crlf = parseChecksums('abc123  iterate-skill.tar.gz\r\n');
+  assert.strictEqual(crlf.get('iterate-skill.tar.gz'), 'abc123', 'CRLF line endings should parse');
+
+  const multi = parseChecksums('aa  a.txt\nbb  b.txt\n');
+  assert.strictEqual(multi.get('a.txt'), 'aa');
+  assert.strictEqual(multi.get('b.txt'), 'bb');
+
+  console.log('mode.test.js: all parseChecksums tests passed');
 }
 
 run().catch((err) => {