npm-pkg-lint 3.2.2 → 3.3.0

package/README.md

@@ -18,9 +18,10 @@ Core principles:
 > npx npm-pkg-lint [--tarball my-pkg-1.2.3.tgz} [--pkgfile package.json]
 
 ```
-usage: npm-pkg-lint [-h] [-v] [-t TARBALL] [-p PKGFILE] [OPTIONS]
+usage: index.js [-h] [-v] [-t TARBALL] [-p PKGFILE] [--cache CACHE]
+                [--allow-types-dependencies] [--ignore-missing-fields]
 
-npm package linter
+Opiniated linter for NPM package tarball and package.json metadata
 
 optional arguments:
   -h, --help            show this help message and exit
@@ -29,6 +30,7 @@ optional arguments:
                         specify tarball location
   -p PKGFILE, --pkgfile PKGFILE
                         specify package.json location
+  --cache CACHE         specify cache directory
   --allow-types-dependencies
                         allow dependencies to `@types/*`
   --ignore-missing-fields

package/dist/index.js

@@ -9013,6 +9013,7 @@ var require_unpack = __commonJS({
     var getFlag = require_get_write_flag();
     var platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
     var isWindows = platform === "win32";
+    var DEFAULT_MAX_DEPTH = 1024;
     var unlinkFile = (path9, cb) => {
       if (!isWindows) {
         return fs5.unlink(path9, cb);
@@ -9091,6 +9092,7 @@ var require_unpack = __commonJS({
         }
         this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : null;
         this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : null;
+        this.maxDepth = typeof opt.maxDepth === "number" ? opt.maxDepth : DEFAULT_MAX_DEPTH;
         this.forceChown = opt.forceChown === true;
         this.win32 = !!opt.win32 || isWindows;
         this.newer = !!opt.newer;
@@ -9123,12 +9125,12 @@ var require_unpack = __commonJS({
         }
       }
       [CHECKPATH](entry) {
+        const p = normPath(entry.path);
+        const parts = p.split("/");
         if (this.strip) {
-          const parts = normPath(entry.path).split("/");
           if (parts.length < this.strip) {
             return false;
           }
-          entry.path = parts.slice(this.strip).join("/");
           if (entry.type === "Link") {
             const linkparts = normPath(entry.linkpath).split("/");
             if (linkparts.length >= this.strip) {
@@ -9137,10 +9139,19 @@ var require_unpack = __commonJS({
               return false;
             }
           }
+          parts.splice(0, this.strip);
+          entry.path = parts.join("/");
+        }
+        if (isFinite(this.maxDepth) && parts.length > this.maxDepth) {
+          this.warn("TAR_ENTRY_ERROR", "path excessively deep", {
+            entry,
+            path: p,
+            depth: parts.length,
+            maxDepth: this.maxDepth
+          });
+          return false;
         }
         if (!this.preservePaths) {
-          const p = normPath(entry.path);
-          const parts = p.split("/");
           if (parts.includes("..") || isWindows && /^[a-z]:\.\.$/i.test(parts[0])) {
             this.warn("TAR_ENTRY_ERROR", `path contains '..'`, {
               entry,
@@ -14975,6 +14986,10 @@ function getFilePath(key) {
   const filename2 = `${hash.slice(0, 2)}/${hash.slice(2)}.json`;
   return path5.join(cacheDir, filename2);
 }
+async function setCacheDirecory(directory2) {
+  await fs3.mkdir(directory2, { recursive: true });
+  cacheDir = directory2;
+}
 async function persistentCacheGet(key) {
   if (!enabled) {
     return null;
@@ -15612,6 +15627,7 @@ async function run() {
   parser.add_argument("-v", "--version", { action: "version", version });
   parser.add_argument("-t", "--tarball", { help: "specify tarball location" });
   parser.add_argument("-p", "--pkgfile", { help: "specify package.json location" });
+  parser.add_argument("--cache", { help: "specify cache directory" });
   parser.add_argument("--allow-types-dependencies", {
     action: "store_true",
     help: "allow dependencies to `@types/*`"
@@ -15621,6 +15637,9 @@ async function run() {
     help: "ignore errors for missing fields (but still checks for empty and valid)"
   });
   const args = parser.parse_args();
+  if (args.cache) {
+    await setCacheDirecory(args.cache);
+  }
   let regenerateReportName = false;
   if (args.tarball === "-") {
     args.tarball = await preloadStdin();