@@ -261,7 +261,7 @@ exports.extract = function (cwd, opts) {
261261 if ( win32 ) return next ( ) // skip symlinks on win for now before it can be tested
262262 xfs . unlink ( name , function ( ) {
263263 var dst = path . resolve ( path . dirname ( name ) , header . linkname )
264- if ( ! dst . startsWith ( path . resolve ( cwd ) ) ) return next ( new Error ( name + ' is not a valid symlink' ) )
264+ if ( ! inCwd ( dst , cwd ) ) return next ( new Error ( name + ' is not a valid symlink' ) )
265265
266266 xfs . symlink ( header . linkname , name , stat )
267267 } )
@@ -273,7 +273,7 @@ exports.extract = function (cwd, opts) {
273273 var srcpath = path . join ( cwd , path . join ( '/' , header . linkname ) )
274274
275275 xfs . realpath ( srcpath , function ( err , dst ) {
276- if ( err || ! dst . startsWith ( path . resolve ( cwd ) ) ) return next ( new Error ( name + ' is not a valid hardlink' ) )
276+ if ( err || ! inCwd ( dst , cwd ) ) return next ( new Error ( name + ' is not a valid hardlink' ) )
277277
278278 xfs . link ( dst , name , function ( err ) {
279279 if ( err && err . code === 'EPERM' && opts . hardlinkAsFilesFallback ) {
@@ -356,3 +356,8 @@ function mkdirfix (name, opts, cb) {
356356 }
357357 } )
358358}
359+
360+ function inCwd ( dst , cwd ) {
361+ cwd = path . resolve ( cwd )
362+ return cwd === dst || dst . startsWith ( cwd + path . sep )
363+ }
0 commit comments