piral-cli 1.5.3-beta.6977 → 1.5.3-beta.6983

package/lib/external/index.js

@@ -48891,6 +48891,7 @@ var require_unpack = __commonJS({
     var getFlag = require_get_write_flag();
     var platform = process.env.TESTING_TAR_FAKE_PLATFORM || process.platform;
     var isWindows = platform === "win32";
+    var DEFAULT_MAX_DEPTH = 1024;
     var unlinkFile = (path2, cb) => {
       if (!isWindows) {
         return fs2.unlink(path2, cb);
@@ -48967,6 +48968,7 @@ var require_unpack = __commonJS({
         }
         this.processUid = (this.preserveOwner || this.setOwner) && process.getuid ? process.getuid() : null;
         this.processGid = (this.preserveOwner || this.setOwner) && process.getgid ? process.getgid() : null;
+        this.maxDepth = typeof opt.maxDepth === "number" ? opt.maxDepth : DEFAULT_MAX_DEPTH;
         this.forceChown = opt.forceChown === true;
         this.win32 = !!opt.win32 || isWindows;
         this.newer = !!opt.newer;
@@ -48996,12 +48998,12 @@ var require_unpack = __commonJS({
         }
       }
       [CHECKPATH](entry) {
+        const p = normPath(entry.path);
+        const parts = p.split("/");
         if (this.strip) {
-          const parts = normPath(entry.path).split("/");
           if (parts.length < this.strip) {
             return false;
           }
-          entry.path = parts.slice(this.strip).join("/");
           if (entry.type === "Link") {
             const linkparts = normPath(entry.linkpath).split("/");
             if (linkparts.length >= this.strip) {
@@ -49010,10 +49012,19 @@ var require_unpack = __commonJS({
               return false;
             }
           }
+          parts.splice(0, this.strip);
+          entry.path = parts.join("/");
+        }
+        if (isFinite(this.maxDepth) && parts.length > this.maxDepth) {
+          this.warn("TAR_ENTRY_ERROR", "path excessively deep", {
+            entry,
+            path: p,
+            depth: parts.length,
+            maxDepth: this.maxDepth
+          });
+          return false;
         }
         if (!this.preservePaths) {
-          const p = normPath(entry.path);
-          const parts = p.split("/");
           if (parts.includes("..") || isWindows && /^[a-z]:\.\.$/i.test(parts[0])) {
             this.warn("TAR_ENTRY_ERROR", `path contains '..'`, {
               entry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "piral-cli",
-  "version": "1.5.3-beta.6977",
+  "version": "1.5.3-beta.6983",
   "description": "The standard CLI for creating and building a Piral instance or a Pilet.",
   "keywords": [
     "portal",
@@ -81,5 +81,5 @@
     "typescript": "^5.0.0",
     "yargs": "^15.0.0"
   },
-  "gitHead": "139acd1a29deaacfb8ed22333b8e333f3acd1047"
+  "gitHead": "bc34c72c2789c34573a6bbaf5082cd235b54495d"
 }