zip-lib 1.2.1 → 1.2.3

package/README.md

@@ -366,7 +366,8 @@ Object
 ### Options: IExtractOptions <a id="iextractoptions"></a>
 
 Object
-- `overwrite?`: String (optional) - If it is true, the target directory will be deleted before extract. The default value is `false`.
+- `overwrite?`: Boolean (optional) - If it is true, the target directory will be deleted before extract. The default value is `false`.
+- `safeSymlinksOnly`: Boolean (optional) - Controls the creation phase of symlinks. The default value is `false`.<br>`true`: Refuses to create any symlink whose target is outside the extraction root.<br>`false`: Allows creating external symlinks. **Note:** Subsequent write operations to these links will still be intercepted by the separate AFWRITE security layer.
 - `symlinkAsFileOnWindows?`: Boolean (optional) - Extract symbolic links as files on Windows. This value is only available on Windows and ignored on other platforms. The default value is `true`.<br>If `true`, the symlink in the zip will be extracted as a normal file on Windows.<br>If `false`, the symlink in the zip will be extracted as a symlink correctly on Windows, but an `EPERM` error will be thrown under non-administrators.
 
     > ⚠**WARNING:** On Windows, the default security policy allows only administrators to create symbolic links. If you set `symlinkAsFileOnWindows` to `false` and the zip contains symlink, be sure to run the code under the administrator, otherwise an `EPERM` error will be thrown.

package/lib/fs.d.ts

@@ -14,6 +14,7 @@ export type FolderStat = {
     realpath: string;
 };
 export type FileType = "file" | "dir";
+export declare function isOutside(baseDir: string, targetPath: string): boolean;
 export declare function realpath(target: string): Promise<string>;
 export declare function readdirp(folder: string): Promise<FileEntry[]>;
 export declare function getFileEntry(target: string): Promise<FileEntry>;

package/lib/fs.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOutside = isOutside;
 exports.realpath = realpath;
 exports.readdirp = readdirp;
 exports.getFileEntry = getFileEntry;
@@ -11,6 +12,12 @@ const fsSync = require("node:fs");
 const fs = require("node:fs/promises");
 const path = require("node:path");
 const util = require("node:util");
+function isOutside(baseDir, targetPath) {
+    const absoluteBase = path.resolve(baseDir);
+    const absoluteTarget = path.resolve(targetPath);
+    const relative = path.relative(absoluteBase, absoluteTarget);
+    return relative.startsWith("..") || path.isAbsolute(relative);
+}
 async function realpath(target) {
     // fs.promises.realpath has a bug with long path on Windows.
     // https://github.com/nodejs/node/issues/51031

package/lib/unzip.d.ts

@@ -18,6 +18,17 @@ export interface IExtractOptions {
      * be sure to run the code under the administrator, otherwise an `EPERM` error will be thrown.
      */
     symlinkAsFileOnWindows?: boolean;
+    /**
+     * Controls the creation phase of symlinks.
+     *
+     * `true`: Refuses to create any symlink whose target is outside the extraction root.
+     *
+     * `false`: Allows creating external symlinks. **Note:** Subsequent write operations to these
+     * links will still be intercepted by the separate AFWRITE security layer.
+     *
+     * The default value is `false`.
+     */
+    safeSymlinksOnly?: boolean;
     /**
      * Called before an item is extracted.
      * @param event

package/lib/unzip.js

@@ -64,12 +64,6 @@ class EntryContext {
             this._symlinkFolders.push({ folder, realpath });
         }
     }
-    isOutside(baseDir, targetPath) {
-        const absoluteBase = path.resolve(baseDir);
-        const absoluteTarget = path.resolve(targetPath);
-        const relative = path.relative(absoluteBase, absoluteTarget);
-        return relative.startsWith("..") || path.isAbsolute(relative);
-    }
     getFilePath() {
         return path.resolve(path.join(this.targetFolder, this.decodeEntryFileName));
     }
@@ -83,6 +77,10 @@ class EntryContext {
         }
         this._ensuredFolders.push(folder);
     }
+    isSymlinkTargetOutsideTargetFolder(linkTarget, linkFilePath) {
+        const fileDir = path.dirname(linkFilePath);
+        return exfs.isOutside(this.realTargetFolder, path.resolve(fileDir, linkTarget));
+    }
     async isOutsideTargetFolder(tpath) {
         if (this._symlinkFileNames.length === 0 && this._symlinkFolders.length === 0) {
             return false;
@@ -92,7 +90,7 @@ class EntryContext {
         }
         for (const { folder, realpath } of this._symlinkFolders) {
             if (tpath.includes(folder)) {
-                if (this.isOutside(this.realTargetFolder, realpath)) {
+                if (exfs.isOutside(this.realTargetFolder, realpath)) {
                     return true;
                 }
             }
@@ -100,7 +98,7 @@ class EntryContext {
         for (const fileName of this._symlinkFileNames) {
             if (tpath.includes(fileName)) {
                 const realFilePath = await exfs.realpath(tpath);
-                if (this.isOutside(this.realTargetFolder, realFilePath)) {
+                if (exfs.isOutside(this.realTargetFolder, realFilePath)) {
                     return true;
                 }
             }
@@ -312,7 +310,16 @@ class Unzip extends cancelable_1.Cancelable {
                         }
                     });
                     readStream.once("end", () => {
-                        this.createSymlink(linkContent, filePath).then(c, e);
+                        var _a;
+                        if (((_a = this.options) === null || _a === void 0 ? void 0 : _a.safeSymlinksOnly) &&
+                            entryContext.isSymlinkTargetOutsideTargetFolder(linkContent, filePath)) {
+                            const error = new Error(`Dangerous link path was refused : "${entryContext.targetFolder}", file: "${filePath}", target: "${linkContent}"`);
+                            error.name = "AF_ILLEGAL_TARGET";
+                            e(error);
+                        }
+                        else {
+                            this.createSymlink(linkContent, filePath).then(c, e);
+                        }
                     });
                 }
                 else {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "zip-lib",
-    "version": "1.2.1",
+    "version": "1.2.3",
     "description": "zip and unzip library for node",
     "main": "lib/index.js",
     "types": "./lib/index.d.ts",
@@ -30,16 +30,16 @@
     "author": "fpsqdb",
     "license": "MIT",
     "dependencies": {
-        "yauzl": "^3.2.0",
+        "yauzl": "^3.2.1",
         "yazl": "^3.3.1"
     },
     "devDependencies": {
-        "@biomejs/biome": "^2.3.14",
-        "@types/node": "^20.19.32",
+        "@biomejs/biome": "^2.4.7",
+        "@types/node": "^20.19.37",
         "@types/yauzl": "^2.10.3",
         "@types/yazl": "^3.3.0",
-        "@vitest/coverage-v8": "^4.0.18",
-        "rimraf": "^6.1.2",
+        "@vitest/coverage-v8": "^4.1.0",
+        "rimraf": "^6.1.3",
         "typescript": "^5.9.3",
         "vitest": "^4.0.18"
     }