Skip to content

Conversation

rohitnb
Copy link

@rohitnb rohitnb commented Mar 25, 2024

This pull request includes a change to the exports.extract function in the index.js file. The change modifies the way source paths are resolved for links. Instead of joining the current working directory (cwd) and the link name using path.join, the code now uses path.resolve to determine the source path. This change should provide a more accurate and reliable way to resolve paths.

if (win32) return next() // skip links on win for now before it can be tested
xfs.unlink(name, function () {
var srcpath = path.join(cwd, path.join('/', header.linkname))
var srcpath = path.resolve(cwd, header.linkname)

Check failure

Code scanning / CodeQL

Arbitrary file access during archive extraction ("Zip Slip")

Unsanitized archive entry, which may contain '..', is used in a [file system operation](1).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants