tar-fs - npm Package Compare versions

Comparing version 3.0.6 to 3.0.7

index.js

@@ -123,2 +123,4 @@ const tar = require('tar-stream')
 
+  cwd = path.resolve(cwd)
+
   const xfs = opts.fs || fs
@@ -220,2 +222,5 @@ const ignore = opts.ignore || opts.filter || noop
       xfs.unlink(name, function () {
+        const dst = path.resolve(path.dirname(name), header.linkname)
+        if (!inCwd(dst)) return next(new Error(name + ' is not a valid symlink'))
+
         xfs.symlink(header.linkname, name, stat)
@@ -228,7 +233,7 @@ })
       xfs.unlink(name, function () {
-        const srcpath = path.join(cwd, path.join('/', header.linkname))
+        const dst = path.join(cwd, path.join('/', header.linkname))
 
-        xfs.link(srcpath, name, function (err) {
+        xfs.link(dst, name, function (err) {
           if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
-            stream = xfs.createReadStream(srcpath)
+            stream = xfs.createReadStream(dst)
             return onfile()
@@ -242,2 +247,6 @@ }
 
+    function inCwd (dst) {
+      return dst.startsWith(cwd)
+    }
+
     function onfile () {
@@ -244,0 +253,0 @@ const ws = xfs.createWriteStream(name)

package.json

 {
   "name": "tar-fs",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "description": "filesystem bindings for tar-stream",
@@ -5,0 +5,0 @@ "dependencies": {

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

17112

1.39%

Lines of code

299

2.05%

Number of low supply chain risk alerts

1

-50%

No dependency changes