@@ -23,15 +23,36 @@ describe('adm-zip', () => {
23
23
const files = walk ( destination )
24
24
25
25
expect ( files . sort ( ) ) . to . deep . equal ( [
26
- "./test/xxx/attributes_test/asd/New Text Document.txt" ,
27
- "./test/xxx/attributes_test/blank file.txt" ,
28
- "./test/xxx/attributes_test/New folder/hidden.txt" ,
29
- "./test/xxx/attributes_test/New folder/hidden_readonly.txt" ,
30
- "./test/xxx/attributes_test/New folder/readonly.txt" ,
31
- "./test/xxx/utes_test/New folder/somefile.txt"
26
+ pth . normalize ( "./test/xxx/attributes_test/asd/New Text Document.txt" ) ,
27
+ pth . normalize ( "./test/xxx/attributes_test/blank file.txt" ) ,
28
+ pth . normalize ( "./test/xxx/attributes_test/New folder/hidden.txt" ) ,
29
+ pth . normalize ( "./test/xxx/attributes_test/New folder/hidden_readonly.txt" ) ,
30
+ pth . normalize ( "./test/xxx/attributes_test/New folder/readonly.txt" ) ,
31
+ pth . normalize ( "./test/xxx/utes_test/New folder/somefile.txt" )
32
32
] . sort ( ) ) ;
33
33
} )
34
34
35
+ it ( 'zip pathTraversal' , ( ) => {
36
+ const target = pth . join ( destination , "test" )
37
+ const zip = new Zip ( ) ;
38
+ zip . addFile ( "../../../test1.ext" , "content" )
39
+ zip . addFile ( "folder/../../test2.ext" , "content" )
40
+ zip . addFile ( "test3.ext" , "content" )
41
+ const buf = zip . toBuffer ( )
42
+
43
+ const extract = new Zip ( buf )
44
+ var zipEntries = zip . getEntries ( ) ;
45
+ zipEntries . forEach ( e => zip . extractEntryTo ( e , destination , false , true ) ) ;
46
+
47
+ extract . extractAllTo ( target )
48
+ const files = walk ( target )
49
+ expect ( files . sort ( ) ) . to . deep . equal ( [
50
+ pth . normalize ( './test/xxx/test/test1.ext' ) ,
51
+ pth . normalize ( './test/xxx/test/test2.ext' ) ,
52
+ pth . normalize ( './test/xxx/test/test3.ext' ) ,
53
+ ] )
54
+ } )
55
+
35
56
it ( 'zip.extractEntryTo(entry, destination, false, true)' , ( ) => {
36
57
const destination = './test/xxx'
37
58
const zip = new Zip ( './test/assets/ultra.zip' ) ;
@@ -40,12 +61,12 @@ describe('adm-zip', () => {
40
61
41
62
const files = walk ( destination )
42
63
expect ( files . sort ( ) ) . to . deep . equal ( [
43
- "./test/xxx/blank file.txt" ,
44
- "./test/xxx/hidden.txt" ,
45
- "./test/xxx/hidden_readonly.txt" ,
46
- "./test/xxx/New Text Document.txt" ,
47
- "./test/xxx/readonly.txt" ,
48
- "./test/xxx/somefile.txt"
64
+ pth . normalize ( "./test/xxx/blank file.txt" ) ,
65
+ pth . normalize ( "./test/xxx/hidden.txt" ) ,
66
+ pth . normalize ( "./test/xxx/hidden_readonly.txt" ) ,
67
+ pth . normalize ( "./test/xxx/New Text Document.txt" ) ,
68
+ pth . normalize ( "./test/xxx/readonly.txt" ) ,
69
+ pth . normalize ( "./test/xxx/somefile.txt" )
49
70
] . sort ( ) ) ;
50
71
} )
51
72
@@ -57,12 +78,12 @@ describe('adm-zip', () => {
57
78
58
79
const files = walk ( destination )
59
80
expect ( files . sort ( ) ) . to . deep . equal ( [
60
- "./test/xxx/attributes_test/asd/New Text Document.txt" ,
61
- "./test/xxx/attributes_test/blank file.txt" ,
62
- "./test/xxx/attributes_test/New folder/hidden.txt" ,
63
- "./test/xxx/attributes_test/New folder/hidden_readonly.txt" ,
64
- "./test/xxx/attributes_test/New folder/readonly.txt" ,
65
- "./test/xxx/utes_test/New folder/somefile.txt"
81
+ pth . normalize ( "./test/xxx/attributes_test/asd/New Text Document.txt" ) ,
82
+ pth . normalize ( "./test/xxx/attributes_test/blank file.txt" ) ,
83
+ pth . normalize ( "./test/xxx/attributes_test/New folder/hidden.txt" ) ,
84
+ pth . normalize ( "./test/xxx/attributes_test/New folder/hidden_readonly.txt" ) ,
85
+ pth . normalize ( "./test/xxx/attributes_test/New folder/readonly.txt" ) ,
86
+ pth . normalize ( "./test/xxx/utes_test/New folder/somefile.txt" )
66
87
] . sort ( ) ) ;
67
88
} )
68
89
@@ -93,7 +114,7 @@ function walk(dir) {
93
114
results = results . concat ( walk ( file ) ) ;
94
115
} else {
95
116
/* Is a file */
96
- results . push ( file ) ;
117
+ results . push ( pth . normalize ( file ) ) ;
97
118
}
98
119
} ) ;
99
120
return results ;
0 commit comments