Skip to content

Commit

Permalink
Properly handle long linkpath in PaxHeader
Browse files Browse the repository at this point in the history
tar-stream creates some interesting tarballs, but they are technically
allowed, and should be handled properly.

Fix: #312

Also, this cleans up a flaky race condition in the unpack test.
  • Loading branch information
isaacs committed Apr 10, 2024
1 parent 314ec7e commit 2d89a4e
Show file tree
Hide file tree
Showing 4 changed files with 21 additions and 2 deletions.
1 change: 1 addition & 0 deletions src/parse.ts
Original file line number Diff line number Diff line change
Expand Up @@ -199,6 +199,7 @@ export class Parser extends EE implements Warner {
})
} else if (
!/^(Symbolic)?Link$/.test(type) &&
!/^(Global)?ExtendedHeader$/.test(type) &&
header.linkpath
) {
this.warn('TAR_ENTRY_INVALID', 'linkpath forbidden', {
Expand Down
14 changes: 14 additions & 0 deletions test/extract.js
Original file line number Diff line number Diff line change
Expand Up @@ -415,3 +415,17 @@ t.test('brotli', async t => {
t.end()
})
})

t.test('verify long linkname is not a problem', async t => {
// See: https://github.com/isaacs/node-tar/issues/312
const file = path.resolve(__dirname, 'fixtures/long-linkname.tar')
t.test('sync', t => {
x({ sync: true, strict: true, file, C: t.testdir({}) })
t.ok(fs.lstatSync(t.testdirName + '/test').isSymbolicLink())
t.end()
})
t.test('async', async t => {
await x({ file, C: t.testdir({}), strict: true })
t.ok(fs.lstatSync(t.testdirName + '/test').isSymbolicLink())
})
})
Binary file added test/fixtures/long-linkname.tar
Binary file not shown.
8 changes: 6 additions & 2 deletions test/unpack.js
Original file line number Diff line number Diff line change
Expand Up @@ -1821,11 +1821,12 @@ t.test('set owner', t => {
if (!warned) {
warned = true
t.equal(er, poop)
t.end()
}
},
})
u.end(data)
t.equal(warned, true)
t.end()
})

t.test('async', t => {
Expand All @@ -1838,10 +1839,13 @@ t.test('set owner', t => {
if (!warned) {
warned = true
t.equal(er, poop)
t.end()
}
},
})
u.on('finish', () => {
t.equal(warned, true)
t.end()
})
u.end(data)
})

Expand Down

0 comments on commit 2d89a4e

Please sign in to comment.