tar - npm Package Compare versions

Comparing version 6.2.0 to 6.2.1

lib/unpack.js

		@@ -51,2 +51,3 @@ 'use strict'
		const isWindows = platform === 'win32'
		const DEFAULT_MAX_DEPTH = 1024

		@@ -185,2 +186,8 @@ // Unlinks on Windows are not atomic.

		// prevent excessively deep nesting of subfolders
		// set to `Infinity` to remove this restriction
		this.maxDepth = typeof opt.maxDepth === 'number'
		? opt.maxDepth
		: DEFAULT_MAX_DEPTH

		// mostly just for testing, but useful in some cases.
		@@ -243,9 +250,9 @@ // Forcibly trigger a chown on every entry, no matter what
		[CHECKPATH] (entry) {
		const p = normPath(entry.path)
		const parts = p.split('/')

		if (this.strip) {
		const parts = normPath(entry.path).split('/')
		if (parts.length < this.strip) {
		return false
		}
		entry.path = parts.slice(this.strip).join('/')

		if (entry.type === 'Link') {
		@@ -259,7 +266,17 @@ const linkparts = normPath(entry.linkpath).split('/')
		}
		parts.splice(0, this.strip)
		entry.path = parts.join('/')
		}

		if (isFinite(this.maxDepth) && parts.length > this.maxDepth) {
		this.warn('TAR_ENTRY_ERROR', 'path excessively deep', {
		entry,
		path: p,
		depth: parts.length,
		maxDepth: this.maxDepth,
		})
		return false
		}

		if (!this.preservePaths) {
		const p = normPath(entry.path)
		const parts = p.split('/')
		if (parts.includes('..') \|\| isWindows && /^[a-z]:\.\.$/i.test(parts[0])) {
		@@ -266,0 +283,0 @@ this.warn('TAR_ENTRY_ERROR', `path contains '..'`, {

package.json

README.md

		@@ -118,2 +118,4 @@ # node-tar
		- an unrecoverable fs error happens during unpacking,
		- an entry is trying to extract into an excessively deep
		location (by default, limited to 1024 subfolders),
		- an entry has `..` in the path and `preservePaths` is not set, or
		@@ -431,2 +433,6 @@ - an entry is extracting through a symbolic link, when `preservePaths` is
		normally.
		- `maxDepth` The maximum depth of subfolders to extract into. This
		defaults to 1024. Anything deeper than the limit will raise a
		warning and skip the entry. Set to `Infinity` to remove the
		limitation.

		@@ -754,2 +760,6 @@ The following options are mostly internal, but can be modified in some
		normally.
		- `maxDepth` The maximum depth of subfolders to extract into. This
		defaults to 1024. Anything deeper than the limit will raise a
		warning and skip the entry. Set to `Infinity` to remove the
		limitation.

		@@ -756,0 +766,0 @@ ### class tar.Unpack.Sync

New alerts