zip-lib 0.7.0 → 0.7.3

package/lib/cancelable.d.ts

@@ -14,7 +14,7 @@ export declare class CancellationToken {
     /**
      * Subscribe a callback when cancellation is requested. The callback
      * only ever fires `once` as cancellation can only happen once.
-     * @param cb A function will be called whent cancellation is requested.
+     * @param cb A function will be called when cancellation is requested.
      * @returns A function that Unsubscribe the cancellation callback.
      */
     onCancelled(cb: () => void): () => void;

package/lib/cancelable.js

@@ -15,7 +15,7 @@ class CancellationToken {
     /**
      * Subscribe a callback when cancellation is requested. The callback
      * only ever fires `once` as cancellation can only happen once.
-     * @param cb A function will be called whent cancellation is requested.
+     * @param cb A function will be called when cancellation is requested.
      * @returns A function that Unsubscribe the cancellation callback.
      */
     onCancelled(cb) {
@@ -63,4 +63,3 @@ class Cancelable {
     }
 }
 exports.Cancelable = Cancelable;
-//# sourceMappingURL=cancelable.js.map

package/lib/fs.js

@@ -173,4 +173,3 @@ function isRootPath(target) {
     return false;
 }
 exports.isRootPath = isRootPath;
-//# sourceMappingURL=fs.js.map

package/lib/index.js

@@ -1,13 +1,17 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
 }));
 var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !exports.hasOwnProperty(p)) __createBinding(exports, m, p);
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extract = exports.archiveFolder = exports.archiveFile = void 0;
@@ -50,4 +54,3 @@ function extract(zipFile, targetFolder, options) {
     return unzip.extract(zipFile, targetFolder);
 }
 exports.extract = extract;
-//# sourceMappingURL=index.js.map

package/lib/unzip.js

@@ -34,6 +34,50 @@ class EntryEvent {
         this._isPrevented = false;
     }
 }
+class EntryContext {
+    constructor(_targetFolder, _realTargetFolder, symlinkAsFileOnWindows) {
+        this._targetFolder = _targetFolder;
+        this._realTargetFolder = _realTargetFolder;
+        this.symlinkAsFileOnWindows = symlinkAsFileOnWindows;
+        this._symlinkFileNames = [];
+    }
+    get decodeEntryFileName() {
+        return this._decodeEntryFileName;
+    }
+    set decodeEntryFileName(name) {
+        this._decodeEntryFileName = name;
+    }
+    get targetFolder() {
+        return this._targetFolder;
+    }
+    get realTargetFolder() {
+        return this._realTargetFolder;
+    }
+    get symlinkFileNames() {
+        return this._symlinkFileNames;
+    }
+    getFilePath() {
+        return path.join(this.targetFolder, this.decodeEntryFileName);
+    }
+    async isOutsideTargetFolder(tpath) {
+        if (this.symlinkFileNames.length === 0) {
+            return false;
+        }
+        if (process.platform === "win32" &&
+            this.symlinkAsFileOnWindows) {
+            return false;
+        }
+        for (const fileName of this.symlinkFileNames) {
+            if (tpath.includes(fileName)) {
+                const realFilePath = await util.realpath(tpath);
+                if (realFilePath.indexOf(this.realTargetFolder) !== 0) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+}
 /**
  * Extract the zip file.
  */
@@ -62,6 +106,7 @@ class Unzip extends cancelable_1.Cancelable {
             return Promise.reject(this.canceledError());
         }
         await exfs.ensureFolder(targetFolder);
+        const realTargetFolder = await util.realpath(targetFolder);
         const zfile = await this.openZip(zipFile, token);
         this.zipFile = zfile;
         zfile.readEntry();
@@ -93,6 +138,7 @@ class Unzip extends cancelable_1.Cancelable {
                 this.closeZip();
                 return;
             }
+            const entryContext = new EntryContext(targetFolder, realTargetFolder, this.symlinkToFile());
             const entryEvent = new EntryEvent(total);
             zfile.on("entry", async (entry) => {
                 // use UTF-8 in all situations
@@ -111,13 +157,14 @@ class Unzip extends cancelable_1.Cancelable {
                 }
                 entryEvent.entryName = fileName;
                 this.onEntryCallback(entryEvent);
+                entryContext.decodeEntryFileName = fileName;
                 try {
                     if (entryEvent.isPrevented) {
                         entryEvent.reset();
                         zfile.readEntry();
                     }
                     else {
-                        await this.handleEntry(zfile, entry, fileName, targetFolder, token);
+                        await this.handleEntry(zfile, entry, entryContext, token);
                     }
                     extractedEntriesCount++;
                     if (extractedEntriesCount === total) {
@@ -165,17 +212,17 @@ class Unzip extends cancelable_1.Cancelable {
             });
         });
     }
-    async handleEntry(zfile, entry, decodeEntryFileName, targetPath, token) {
-        if (/\/$/.test(decodeEntryFileName)) {
+    async handleEntry(zfile, entry, entryContext, token) {
+        if (/\/$/.test(entryContext.decodeEntryFileName)) {
             // Directory file names end with '/'.
             // Note that entires for directories themselves are optional.
             // An entry's fileName implicitly requires its parent directories to exist.
-            await exfs.ensureFolder(path.join(targetPath, decodeEntryFileName));
+            await exfs.ensureFolder(entryContext.getFilePath());
             zfile.readEntry();
         }
         else {
             // file entry
-            await this.extractEntry(zfile, entry, decodeEntryFileName, targetPath, token);
+            await this.extractEntry(zfile, entry, entryContext, token);
         }
     }
     openZipFileStream(zfile, entry, token) {
@@ -190,22 +237,21 @@ class Unzip extends cancelable_1.Cancelable {
             });
         });
     }
-    async extractEntry(zfile, entry, decodeEntryFileName, targetPath, token) {
-        const filePath = path.join(targetPath, decodeEntryFileName);
+    async extractEntry(zfile, entry, entryContext, token) {
+        const filePath = entryContext.getFilePath();
         const fileDir = path.dirname(filePath);
         await exfs.ensureFolder(fileDir);
-        const realFilePath = await util.realpath(fileDir);
-        const realTargetPath = await util.realpath(targetPath);
-        if (realFilePath.indexOf(realTargetPath) !== 0) {
-            const error = new Error(`Refuse to write file outside "${targetPath}", path: "${realFilePath}"`);
+        const outside = await entryContext.isOutsideTargetFolder(fileDir);
+        if (outside) {
+            const error = new Error(`Refuse to write file outside "${entryContext.targetFolder}", file: "${filePath}"`);
             error.name = "AFWRITE";
             return Promise.reject(error);
         }
         const readStream = await this.openZipFileStream(zfile, entry, token);
-        await this.writeEntryToFile(readStream, entry, filePath, token);
+        await this.writeEntryToFile(readStream, entry, entryContext, token);
         zfile.readEntry();
     }
-    async writeEntryToFile(readStream, entry, filePath, token) {
+    async writeEntryToFile(readStream, entry, entryContext, token) {
         let fileStream;
         token.onCancelled(() => {
             if (fileStream) {
@@ -215,12 +261,16 @@ class Unzip extends cancelable_1.Cancelable {
         });
         return new Promise(async (c, e) => {
             try {
+                const filePath = entryContext.getFilePath();
                 const mode = this.modeFromEntry(entry);
                 // see https://unix.stackexchange.com/questions/193465/what-file-mode-is-a-symlink
                 const isSymlink = ((mode & 0o170000) === 0o120000);
                 readStream.once("error", (err) => {
                     e(this.wrapError(err, token.isCancelled));
                 });
+                if (isSymlink) {
+                    entryContext.symlinkFileNames.push(entryContext.decodeEntryFileName);
+                }
                 if (isSymlink && !this.symlinkToFile()) {
                     let linkContent = "";
                     readStream.on("data", (chunk) => {
@@ -236,7 +286,7 @@ class Unzip extends cancelable_1.Cancelable {
                     });
                 }
                 else {
-                    fileStream = fs_1.createWriteStream(filePath, { mode });
+                    fileStream = (0, fs_1.createWriteStream)(filePath, { mode });
                     fileStream.once("close", () => c());
                     fileStream.once("error", (err) => {
                         e(this.wrapError(err, token.isCancelled));
@@ -257,22 +307,24 @@ class Unzip extends cancelable_1.Cancelable {
     }
     async createSymlink(linkContent, des) {
         let linkType = "file";
-        if (/\/$/.test(linkContent)) {
-            linkType = "dir";
-        }
-        else {
-            let targetPath = linkContent;
-            if (!path.isAbsolute(linkContent)) {
-                targetPath = path.join(path.dirname(des), linkContent);
+        if (process.platform === 'win32') {
+            if (/\/$/.test(linkContent)) {
+                linkType = "dir";
             }
-            try {
-                const stat = await util.stat(targetPath);
-                if (stat.isDirectory()) {
-                    linkType = "dir";
+            else {
+                let targetPath = linkContent;
+                if (!path.isAbsolute(linkContent)) {
+                    targetPath = path.join(path.dirname(des), linkContent);
+                }
+                try {
+                    const stat = await util.stat(targetPath);
+                    if (stat.isDirectory()) {
+                        linkType = "dir";
+                    }
+                }
+                catch (error) {
+                    // ignore
                 }
-            }
-            catch (error) {
-                // ignore
             }
         }
         await util.symlink(linkContent, des, linkType);
@@ -304,4 +356,3 @@ class Unzip extends cancelable_1.Cancelable {
     }
 }
 exports.Unzip = Unzip;
-//# sourceMappingURL=unzip.js.map

package/lib/util.js

@@ -47,4 +47,3 @@ function readlink(path) {
     return util.promisify(fs.readlink)(path);
 }
 exports.readlink = readlink;
-//# sourceMappingURL=util.js.map

package/lib/zip.js

@@ -70,7 +70,7 @@ class Zip extends cancelable_1.Cancelable {
             });
             const zip = this.yazlFile;
             if (!token.isCancelled) {
-                this.zipStream = fs_1.createWriteStream(zipFile);
+                this.zipStream = (0, fs_1.createWriteStream)(zipFile);
                 this.zipStream.once("error", (err) => {
                     e(this.wrapError(err, token.isCancelled));
                 });
@@ -145,7 +145,7 @@ class Zip extends cancelable_1.Cancelable {
     }
     addFileStream(zip, file, metadataPath, token) {
         return new Promise((c, e) => {
-            const fileStream = fs_1.createReadStream(file.path);
+            const fileStream = (0, fs_1.createReadStream)(file.path);
             fileStream.once("error", (err) => {
                 const wrappedError = this.wrapError(err, token.isCancelled);
                 this.stopPipe(wrappedError);
@@ -211,4 +211,3 @@ class Zip extends cancelable_1.Cancelable {
     }
 }
 exports.Zip = Zip;
-//# sourceMappingURL=zip.js.map

package/package.json

@@ -1,12 +1,14 @@
 {
     "name": "zip-lib",
-    "version": "0.7.0",
+    "version": "0.7.3",
     "description": "zip and unzip library for node",
     "main": "lib/index.js",
     "scripts": {
         "compile": "rimraf ./lib && tsc -p ./src/tsconfig.json",
+        "release": "rimraf ./lib && tsc -p ./src/tsconfig.release.json",
         "compile-test": "rimraf ./test/out && tsc -p ./test/src/tsconfig.json",
-        "test": "node ./test/src/before.js && mocha ./test/out --timeout 10000"
+        "test": "node ./test/src/before.js && mocha ./test/out --timeout 10000",
+        "pack": "npm run release && npm pack"
     },
     "repository": {
         "type": "git",
@@ -17,9 +19,12 @@
     },
     "keywords": [
         "zip",
+        "folder",
         "unzip",
         "archive",
-        "extract"
+        "extract",
+        "promise",
+        "async"
     ],
     "author": "fpsqdb",
     "license": "MIT",
@@ -28,12 +33,12 @@
         "yazl": "^2.5.1"
     },
     "devDependencies": {
-        "@types/mocha": "^7.0.2",
-        "@types/node": "^8.10.61",
+        "@types/mocha": "^9.1.0",
+        "@types/node": "^8.10.66",
         "@types/yauzl": "^2.9.1",
         "@types/yazl": "^2.4.2",
-        "mocha": "^7.2.0",
+        "mocha": "^9.2.0",
         "rimraf": "^3.0.2",
-        "typescript": "^3.9.3"
+        "typescript": "^4.1.3"
     }
 }