unzip-stream - npm Package Compare versions

Comparing version 0.1.2 to 0.2.0

lib/extract.js

@@ -0,27 +1,75 @@
+var fs = require('fs');
 var path = require('path');
 var util = require('util');
-var Writer = require('fstream').Writer;
-var ParserStream = require('./parser-stream');
+var mkdirp = require('mkdirp');
+var Transform = require('stream').Transform;
+var UnzipStream = require('./unzip-stream');
 
 function Extract (opts) {
-  if (!(this instanceof Extract))
+    if (!(this instanceof Extract))
     return new Extract(opts);
 
-  var self = this;
+    Transform.call(this);
 
-  ParserStream.call(self,opts);
+    this.opts = opts || {};
+    this.unzipStream = new UnzipStream();
+    this.unfinishedEntries = [];
 
-  self.on('data', function(entry) {
-    if (entry.isDirectory) return;
-    entry.pipe(Writer({
-      path: path.join(opts.path,entry.path)
-    }))
-    .on('error',function(e) {
-      self.emit('error',e);
+    var self = this;
+    this.unzipStream.on('entry', this._processEntry.bind(this));
+    this.unzipStream.on('error', function(error) {
+        self.emit('error', error);
     });
-  });
 }
 
-util.inherits(Extract, ParserStream);
+util.inherits(Extract, Transform);
 
+Extract.prototype._transform = function (chunk, encoding, cb) {
+    this.unzipStream.write(chunk, encoding, cb);
+}
+
+Extract.prototype._flush = function (cb) {
+    var self = this;
+    var allDone = function() {
+        process.nextTick(function() { self.emit('close'); });
+        cb();
+    }
+
+    this.unzipStream.end(function() {
+        if (self.unfinishedEntries.length === 0) return allDone();
+
+        var waitingEntries = self.unfinishedEntries.length;
+        var finishedFn = function() {
+            waitingEntries--;
+            if (waitingEntries === 0) return allDone();
+        }
+        for(var i=0; i < waitingEntries; i++) {
+            self.unfinishedEntries[i].on('finish', finishedFn);
+        }
+    });
+}
+
+Extract.prototype._processEntry = function (entry) {
+    var self = this;
+    var destPath = path.join(this.opts.path, entry.path);
+    var directory = entry.isDirectory ? destPath : path.dirname(destPath);
+
+    mkdirp(directory, function(err) {
+        if (err) return self.emit('error', err);
+        if (entry.isDirectory) return;
+
+        var pipedStream = fs.createWriteStream(destPath);
+        self.unfinishedEntries.push(pipedStream);
+        pipedStream.on('finish', function() {
+            var idx = self.unfinishedEntries.indexOf(pipedStream);
+            if (idx < 0) return;
+            self.unfinishedEntries.splice(idx, 1);
+        });
+        pipedStream.on('error', function (error) {
+            self.emit('error', error);
+        });
+        entry.pipe(pipedStream);
+    });
+}
+
 module.exports = Extract;

lib/parser-stream.js

@@ -15,3 +15,2 @@ var Transform = require('stream').Transform;
     this.unzipStream = new UnzipStream();
-    this.finishCb = null;
 
@@ -34,4 +33,5 @@ var self = this;
 ParserStream.prototype._flush = function (cb) {
-    this.unzipStream.end(() => {
-        this.emit('close'); // compatibility with node-unzip
+    var self = this;
+    this.unzipStream.end(function() {
+        process.nextTick(function() { self.emit('close'); });
         cb();
@@ -38,0 +38,0 @@ });

lib/unzip-stream.js

@@ -153,2 +153,4 @@ var binary = require('binary');
     var isDirectory = vars.compressedSize === 0 && /[\/\\]$/.test(entry.path);
+    // protect against malicious zip files which want to extract to parent dirs
+    entry.path = entry.path.replace(/^([/\\]*[.]+[/\\]+)*[/\\]*/, "");
     entry.type = isDirectory ? 'Directory' : 'File';
@@ -155,0 +157,0 @@ entry.isDirectory = isDirectory;

package.json

 {
   "name": "unzip-stream",
-  "version": "0.1.2",
-  "description": "Unzip cross-platform streaming API compatible with fstream",
+  "version": "0.2.0",
+  "description": "Process zip files using streaming API",
   "author": "Michal Hruby <[e-mail]>",
@@ -19,3 +19,3 @@ "maintainers": [
     "binary": "^0.3.0",
-    "fstream": "^1.0.10"
+    "mkdirp": "^0.5.1"
   },
@@ -22,0 +22,0 @@ "devDependencies": {

README.md

@@ -72,3 +72,3 @@ # unzip-stream
 
-Extract emits the 'finish' (also 'close' for compatibility with unzip) event once the zip's contents have been fully extracted to disk.
+Extract will emit the 'close' event when the archive is fully extracted, do NOT use the 'finish' event, which can be emitted before the writing finishes.
 
@@ -75,0 +75,0 @@ ### What's missing?

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

44916

increased by1.01%

Worsened metrics

Number of package files

27

decreased by-3.57%

Lines of code

729

decreased by-0.27%

Dependency changes

• + Addedmkdirp@^0.5.1

• - Removedfstream@^1.0.10

• - Removedbalanced-match@1.0.2(transitive)

• - Removedbrace-expansion@1.1.11(transitive)

• - Removedconcat-map@0.0.1(transitive)

• - Removedfs.realpath@1.0.0(transitive)

• - Removedfstream@1.0.12(transitive)

• - Removedglob@7.2.3(transitive)

• - Removedgraceful-fs@4.2.11(transitive)

• - Removedinflight@1.0.6(transitive)

• - Removedinherits@2.0.4(transitive)

• - Removedminimatch@3.1.2(transitive)

• - Removedonce@1.4.0(transitive)

• - Removedpath-is-absolute@1.0.1(transitive)

• - Removedrimraf@2.7.1(transitive)

• - Removedwrappy@1.0.2(transitive)