npm-pkg-lint 3.2.2 → 3.2.3

package/dist/index.js

@@ -9013,6 +9013,7 @@ var require_unpack = __commonJS({
     var getFlag = require_get_write_flag();
     var platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
     var isWindows = platform === "win32";
+    var DEFAULT_MAX_DEPTH = 1024;
     var unlinkFile = (path9, cb) => {
       if (!isWindows) {
         return fs5.unlink(path9, cb);
@@ -9091,6 +9092,7 @@ var require_unpack = __commonJS({
         }
         this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : null;
         this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : null;
+        this.maxDepth = typeof opt.maxDepth === "number" ? opt.maxDepth : DEFAULT_MAX_DEPTH;
         this.forceChown = opt.forceChown === true;
         this.win32 = !!opt.win32 || isWindows;
         this.newer = !!opt.newer;
@@ -9123,12 +9125,12 @@ var require_unpack = __commonJS({
         }
       }
       [CHECKPATH](entry) {
+        const p = normPath(entry.path);
+        const parts = p.split("/");
         if (this.strip) {
-          const parts = normPath(entry.path).split("/");
           if (parts.length < this.strip) {
             return false;
           }
-          entry.path = parts.slice(this.strip).join("/");
           if (entry.type === "Link") {
             const linkparts = normPath(entry.linkpath).split("/");
             if (linkparts.length >= this.strip) {
@@ -9137,10 +9139,19 @@ var require_unpack = __commonJS({
               return false;
             }
           }
+          parts.splice(0, this.strip);
+          entry.path = parts.join("/");
+        }
+        if (isFinite(this.maxDepth) && parts.length > this.maxDepth) {
+          this.warn("TAR_ENTRY_ERROR", "path excessively deep", {
+            entry,
+            path: p,
+            depth: parts.length,
+            maxDepth: this.maxDepth
+          });
+          return false;
         }
         if (!this.preservePaths) {
-          const p = normPath(entry.path);
-          const parts = p.split("/");
           if (parts.includes("..") || isWindows && /^[a-z]:\.\.$/i.test(parts[0])) {
             this.warn("TAR_ENTRY_ERROR", `path contains '..'`, {
               entry,