Skip to content

Commit fd1634e

Browse files
committed
symlink tweak from main
1 parent 7ec11cb commit fd1634e

File tree

2 files changed

+4
-1
lines changed

2 files changed

+4
-1
lines changed

index.js

+3
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,9 @@ exports.extract = function (cwd, opts) {
260260
var onsymlink = function () {
261261
if (win32) return next() // skip symlinks on win for now before it can be tested
262262
xfs.unlink(name, function () {
263+
var dst = path.resolve(path.dirname(name), header.linkname)
264+
if (!dst.startsWith(path.resolve(cwd))) return next(new Error(name + ' is not a valid symlink'))
265+
263266
xfs.symlink(header.linkname, name, stat)
264267
})
265268
}

test/index.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,7 @@ test('do not extract invalid tar', function (t) {
304304
fs.createReadStream(a)
305305
.pipe(tar.extract(out))
306306
.on('error', function (err) {
307-
t.ok(/is not a valid path/i.test(err.message))
307+
t.ok(/is not a valid symlink/i.test(err.message))
308308
fs.stat(path.join(out, '../bar'), function (err) {
309309
t.ok(err)
310310
t.end()

0 commit comments

Comments
 (0)