npm-pkg-lint 5.1.1 → 5.1.2

package/dist/index.js

@@ -3452,13 +3452,20 @@ var require_tmp = __commonJS({
       ].join("");
       return path8.join(tmpDir, opts.dir, name);
     }
+    function _assertPath(path9) {
+      if (path9.includes("..")) {
+        throw new Error("Relative value not allowed");
+      }
+      return path9;
+    }
     function _assertOptionsBase(options) {
       if (!_isUndefined(options.name)) {
         const name = options.name;
         if (path8.isAbsolute(name)) throw new Error(`name option must not contain an absolute path, found "${name}".`);
         const basename = path8.basename(name);
-        if (basename === ".." || basename === "." || basename !== name)
+        if (basename === ".." || basename === "." || basename !== name) {
           throw new Error(`name option must not contain a path, found "${name}".`);
+        }
       }
       if (!_isUndefined(options.template) && !options.template.match(TEMPLATE_PATTERN)) {
         throw new Error(`Invalid template, found "${options.template}".`);
@@ -3471,15 +3478,16 @@ var require_tmp = __commonJS({
       options.detachDescriptor = !!options.detachDescriptor;
       options.discardDescriptor = !!options.discardDescriptor;
       options.unsafeCleanup = !!options.unsafeCleanup;
-      options.prefix = _isUndefined(options.prefix) ? "" : options.prefix;
-      options.postfix = _isUndefined(options.postfix) ? "" : options.postfix;
+      options.prefix = _isUndefined(options.prefix) ? "" : _assertPath(options.prefix);
+      options.postfix = _isUndefined(options.postfix) ? "" : _assertPath(options.postfix);
+      options.template = _isUndefined(options.template) ? void 0 : _assertPath(options.template);
     }
     function _getRelativePath(option, name, tmpDir, cb) {
       if (_isUndefined(name)) return cb(null);
       _resolvePath(name, tmpDir, function(err, resolvedPath) {
         if (err) return cb(err);
         const relativePath = path8.relative(tmpDir, resolvedPath);
-        if (!resolvedPath.startsWith(tmpDir)) {
+        if (relativePath.startsWith("..") || path8.isAbsolute(relativePath)) {
           return cb(new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath}".`));
         }
         cb(null, relativePath);
@@ -3489,7 +3497,7 @@ var require_tmp = __commonJS({
       if (_isUndefined(name)) return;
       const resolvedPath = _resolvePathSync(name, tmpDir);
       const relativePath = path8.relative(tmpDir, resolvedPath);
-      if (!resolvedPath.startsWith(tmpDir)) {
+      if (relativePath.startsWith("..") || path8.isAbsolute(relativePath)) {
         throw new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath}".`);
       }
       return relativePath;