modern-tar 0.5.2 → 0.5.3

package/dist/fs/index.js

@@ -6,6 +6,42 @@ import { PassThrough, Readable, Writable } from "node:stream";
 import { createWriteStream } from "node:fs";
 import { pipeline } from "node:stream/promises";
 
+//#region src/fs/path.ts
+const unicodeCache = /* @__PURE__ */ new Map();
+const normalizeUnicode = (s) => {
+	let result = unicodeCache.get(s);
+	if (result !== void 0) unicodeCache.delete(s);
+	result = result ?? s.normalize("NFD");
+	unicodeCache.set(s, result);
+	if (unicodeCache.size > 1e4) unicodeCache.delete(unicodeCache.keys().next().value);
+	return result;
+};
+function validateBounds(targetPath, destDir, errorMessage) {
+	const target = normalizeUnicode(path.resolve(targetPath));
+	const dest = path.resolve(destDir);
+	if (target !== dest && !target.startsWith(dest + path.sep)) throw new Error(errorMessage);
+}
+const win32Reserved = {
+	":": "",
+	"<": "",
+	">": "",
+	"|": "",
+	"?": "",
+	"*": "",
+	"\"": ""
+};
+function normalizeName(name) {
+	const path$1 = name.replace(/\\/g, "/");
+	if (path$1.split("/").includes("..") || /^[a-zA-Z]:\.\./.test(path$1)) throw new Error(`${name} points outside extraction directory`);
+	let relative = path$1;
+	if (/^[a-zA-Z]:/.test(relative)) relative = relative.replace(/^[a-zA-Z]:[/\\]?/, "");
+	else if (relative.startsWith("/")) relative = relative.replace(/^\/+/, "");
+	if (process.platform === "win32") return relative.replace(/[<>:"|?*]/g, (char) => win32Reserved[char]);
+	return relative;
+}
+const normalizeHeaderName = (s) => normalizeUnicode(normalizeName(s.replace(/\/+$/, "")));
+
+//#endregion
 //#region src/fs/pack.ts
 const packTarSources = packTar;
 function packTar(sources, options = {}) {
@@ -96,7 +132,7 @@ function packTar(sources, options = {}) {
 		};
 		const processJob = async (job, index) => {
 			let jobResult = null;
-			const target = job.target.replace(/\\/g, "/");
+			const target = normalizeName(job.target);
 			try {
 				if (job.type === "content" || job.type === "stream") {
 					let body$1;
@@ -206,52 +242,6 @@ function packTar(sources, options = {}) {
 	return stream;
 }
 
-//#endregion
-//#region src/fs/win-path.ts
-const REPLACEMENTS = {
-	":": "",
-	"<": "",
-	">": "",
-	"|": "",
-	"?": "",
-	"*": "",
-	"\"": ""
-};
-function normalizeWindowsPath(p) {
-	if (!(process.platform === "win32")) return p;
-	const normalized = p.replace(/\\/g, "/");
-	if (/^[A-Za-z]:\.\./i.test(normalized)) throw new Error(`Entry ${p} points outside extraction directory.`);
-	return normalized.replace(/^[A-Za-z]:/, "").replace(/[<>:"|?*]/g, (char) => REPLACEMENTS[char]);
-}
-
-//#endregion
-//#region src/fs/path.ts
-const unicodeCache = /* @__PURE__ */ new Map();
-const normalizeUnicode = (s) => {
-	let result = unicodeCache.get(s);
-	if (result !== void 0) unicodeCache.delete(s);
-	result = result ?? s.normalize("NFD");
-	unicodeCache.set(s, result);
-	if (unicodeCache.size > 1e4) unicodeCache.delete(unicodeCache.keys().next().value);
-	return result;
-};
-function stripTrailingSlashes(p) {
-	let i = p.length - 1;
-	if (i === -1 || p[i] !== "/") return p;
-	let slashesStart = i;
-	while (i > -1 && p[i] === "/") {
-		slashesStart = i;
-		i--;
-	}
-	return p.slice(0, slashesStart);
-}
-const normalizeHeaderName = (s) => normalizeUnicode(normalizeWindowsPath(stripTrailingSlashes(s)));
-function validateBounds(targetPath, destDir, errorMessage) {
-	const target = normalizeUnicode(path.resolve(targetPath));
-	const dest = path.resolve(destDir);
-	if (target !== dest && !target.startsWith(dest + path.sep)) throw new Error(errorMessage);
-}
-
 //#endregion
 //#region src/fs/unpack.ts
 function unpackTar(directoryPath, options = {}) {
@@ -389,7 +379,6 @@ function createFSHandler(directoryPath, options) {
 							try {
 								const destDir = await destDirPromise;
 								if (maxDepth !== Infinity && name.split("/").length > maxDepth) throw new Error("Tar exceeds max specified depth.");
-								if (path.isAbsolute(name)) throw new Error(`Absolute path found in "${transformed.name}".`);
 								const outPath = path.join(destDir.symbolic, name);
 								validateBounds(outPath, destDir.symbolic, `Entry "${transformed.name}" points outside the extraction directory.`);
 								const parentDir = path.dirname(outPath);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "modern-tar",
-	"version": "0.5.2",
+	"version": "0.5.3",
 	"description": "Zero dependency streaming tar parser and writer for JavaScript.",
 	"author": "Ayuhito <hello@ayuhito.com>",
 	"license": "MIT",