|
| 1 | +From 7f2ff2574edbb046718122175286c08cf53511ba Mon Sep 17 00:00:00 2001 |
| 2 | +From: Mathias Buus <mathiasbuus@gmail.com> |
| 3 | +Date: Sun, 12 Jan 2025 11:53:11 +0100 |
| 4 | +Subject: [PATCH] refactor and throw on bad symlink |
| 5 | + |
| 6 | +Upstream Patch Reference : https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed |
| 7 | +--- |
| 8 | + .../bower/lib/node_modules/tar-fs/index.js | 15 ++++++++++++--- |
| 9 | + .../bower/lib/node_modules/tar-fs/test/index.js | 2 +- |
| 10 | + 2 files changed, 13 insertions(+), 4 deletions(-) |
| 11 | + |
| 12 | +diff --git a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js |
| 13 | +index 4d67485..3fd93bc 100644 |
| 14 | +--- a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js |
| 15 | ++++ b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js |
| 16 | +@@ -173,6 +173,8 @@ exports.extract = function (cwd, opts) { |
| 17 | + if (!cwd) cwd = '.' |
| 18 | + if (!opts) opts = {} |
| 19 | + |
| 20 | ++ cwd = path.resolve(cwd) |
| 21 | ++ |
| 22 | + var xfs = opts.fs || fs |
| 23 | + var ignore = opts.ignore || opts.filter || noop |
| 24 | + var map = opts.map || noop |
| 25 | +@@ -254,6 +256,9 @@ exports.extract = function (cwd, opts) { |
| 26 | + var onsymlink = function () { |
| 27 | + if (win32) return next() // skip symlinks on win for now before it can be tested |
| 28 | + xfs.unlink(name, function () { |
| 29 | ++ var dst = path.resolve(path.dirname(name), header.linkname) |
| 30 | ++ if (!inCwd(dst)) return next(new Error(name + ' is not a valid symlink')) |
| 31 | ++ |
| 32 | + xfs.symlink(header.linkname, name, stat) |
| 33 | + }) |
| 34 | + } |
| 35 | +@@ -261,11 +266,11 @@ exports.extract = function (cwd, opts) { |
| 36 | + var onlink = function () { |
| 37 | + if (win32) return next() // skip links on win for now before it can be tested |
| 38 | + xfs.unlink(name, function () { |
| 39 | +- var srcpath = path.join(cwd, path.join('/', header.linkname)) |
| 40 | ++ var dst = path.join(cwd, path.join('/', header.linkname)) |
| 41 | + |
| 42 | +- xfs.link(srcpath, name, function (err) { |
| 43 | ++ xfs.link(dst, name, function (err) { |
| 44 | + if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) { |
| 45 | +- stream = xfs.createReadStream(srcpath) |
| 46 | ++ stream = xfs.createReadStream(dst) |
| 47 | + return onfile() |
| 48 | + } |
| 49 | + |
| 50 | +@@ -274,6 +279,10 @@ exports.extract = function (cwd, opts) { |
| 51 | + }) |
| 52 | + } |
| 53 | + |
| 54 | ++ var inCwd = function (dst) { |
| 55 | ++ return dst.startsWith(cwd) |
| 56 | ++ } |
| 57 | ++ |
| 58 | + var onfile = function () { |
| 59 | + var ws = xfs.createWriteStream(name) |
| 60 | + var rs = mapStream(stream, header) |
| 61 | +diff --git a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js |
| 62 | +index a03844e..cbe2ac2 100644 |
| 63 | +--- a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js |
| 64 | ++++ b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js |
| 65 | +@@ -304,7 +304,7 @@ test('do not extract invalid tar', function (t) { |
| 66 | + fs.createReadStream(a) |
| 67 | + .pipe(tar.extract(out)) |
| 68 | + .on('error', function (err) { |
| 69 | +- t.ok(/is not a valid path/i.test(err.message)) |
| 70 | ++ t.ok(/is not a valid symlink/i.test(err.message)) |
| 71 | + fs.stat(path.join(out, '../bar'), function (err) { |
| 72 | + t.ok(err) |
| 73 | + t.end() |
| 74 | +-- |
| 75 | +2.40.4 |
| 76 | + |
0 commit comments