Skip to content

Commit 8c0d5fd

Browse files
owlstronautowlstronaut
committed
deps: tar@7.5.16
1 parent 967d377 commit 8c0d5fd

11 files changed

Lines changed: 173 additions & 64 deletions

File tree

‎node_modules/tar/dist/commonjs/header.js‎

Lines changed: 51 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -78,22 +78,45 @@ class Header {
7878
if (!buf || !(buf.length >= off + 512)) {
7979
throw new Error('need 512 bytes for header');
8080
}
81-
this.path = ex?.path ?? decString(buf, off, 100);
82-
this.mode = ex?.mode ?? gex?.mode ?? decNumber(buf, off + 100, 8);
83-
this.uid = ex?.uid ?? gex?.uid ?? decNumber(buf, off + 108, 8);
84-
this.gid = ex?.gid ?? gex?.gid ?? decNumber(buf, off + 116, 8);
85-
this.size = ex?.size ?? gex?.size ?? decNumber(buf, off + 124, 12);
86-
this.mtime = ex?.mtime ?? gex?.mtime ?? decDate(buf, off + 136, 12);
81+
// Decode the typeflag (independent of any pending PAX/GNU extended header)
82+
// up front so we can tell whether THIS block is itself an intermediary
83+
// extension header (PAX `x`/`g`, GNU long-name `L`, GNU long-link `K`).
84+
// Per POSIX pax, a PAX extended header describes the *next file entry*, not
85+
// the extension headers that may sit between it and that file. Applying the
86+
// pending PAX overrides (notably `size`) to an intervening `L`/`K`/`x`/`g`
87+
// header desynchronizes the stream relative to other tar implementations
88+
// and enables tar interpretation-conflict / file-smuggling attacks.
89+
const t = decString(buf, off + 156, 1);
90+
const isNormalFS = types.normalFsTypes.has(t);
91+
const exForFields = isNormalFS ? ex : undefined;
92+
const gexForFields = isNormalFS ? gex : undefined;
93+
this.path = exForFields?.path ?? decString(buf, off, 100);
94+
this.mode =
95+
exForFields?.mode ??
96+
gexForFields?.mode ??
97+
decNumber(buf, off + 100, 8);
98+
this.uid =
99+
exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
100+
this.gid =
101+
exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
102+
this.size =
103+
exForFields?.size ??
104+
gexForFields?.size ??
105+
decNumber(buf, off + 124, 12);
106+
this.mtime =
107+
exForFields?.mtime ??
108+
gexForFields?.mtime ??
109+
decDate(buf, off + 136, 12);
87110
this.cksum = decNumber(buf, off + 148, 12);
88111
// if we have extended or global extended headers, apply them now
89112
// See https://github.com/npm/node-tar/pull/187
90-
// Apply global before local, so it overrides
91-
if (gex)
92-
this.#slurp(gex, true);
93-
if (ex)
94-
this.#slurp(ex);
113+
// Apply global before local, so it overrides. Never slurp the pending
114+
// extended-header fields onto an intermediary extension header.
115+
if (gexForFields)
116+
this.#slurp(gexForFields, true);
117+
if (exForFields)
118+
this.#slurp(exForFields);
95119
// old tar versions marked dirs as a file with a trailing /
96-
const t = decString(buf, off + 156, 1);
97120
if (types.isCode(t)) {
98121
this.#type = t || '0';
99122
}
@@ -111,12 +134,24 @@ class Header {
111134
this.linkpath = decString(buf, off + 157, 100);
112135
if (buf.subarray(off + 257, off + 265).toString() === 'ustar\u000000') {
113136
/* c8 ignore start */
114-
this.uname = ex?.uname ?? gex?.uname ?? decString(buf, off + 265, 32);
115-
this.gname = ex?.gname ?? gex?.gname ?? decString(buf, off + 297, 32);
137+
this.uname =
138+
exForFields?.uname ??
139+
gexForFields?.uname ??
140+
decString(buf, off + 265, 32);
141+
this.gname =
142+
exForFields?.gname ??
143+
gexForFields?.gname ??
144+
decString(buf, off + 297, 32);
116145
this.devmaj =
117-
ex?.devmaj ?? gex?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
146+
exForFields?.devmaj ??
147+
gexForFields?.devmaj ??
148+
decNumber(buf, off + 329, 8) ??
149+
0;
118150
this.devmin =
119-
ex?.devmin ?? gex?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
151+
exForFields?.devmin ??
152+
gexForFields?.devmin ??
153+
decNumber(buf, off + 337, 8) ??
154+
0;
120155
/* c8 ignore stop */
121156
if (buf[off + 475] !== 0) {
122157
// definitely a prefix, definitely >130 chars.

‎node_modules/tar/dist/commonjs/index.min.js‎

Lines changed: 3 additions & 3 deletions
Large diffs are not rendered by default.

‎node_modules/tar/dist/commonjs/pack.js‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,13 +66,12 @@ exports.PackJob = PackJob;
6666
const minipass_1 = require("minipass");
6767
const zlib = __importStar(require("minizlib"));
6868
const yallist_1 = require("yallist");
69-
const read_entry_js_1 = require("./read-entry.js");
7069
const warn_method_js_1 = require("./warn-method.js");
7170
const EOF = Buffer.alloc(1024);
7271
const ONSTAT = Symbol('onStat');
7372
const ENDED = Symbol('ended');
7473
const QUEUE = Symbol('queue');
75-
const PENDINGLINKS = Symbol('queue');
74+
const PENDINGLINKS = Symbol('pendingLinks');
7675
const CURRENT = Symbol('current');
7776
const PROCESS = Symbol('process');
7877
const PROCESSING = Symbol('processing');
@@ -230,11 +229,11 @@ class Pack extends minipass_1.Minipass {
230229
if (this[ENDED]) {
231230
throw new Error('write after end');
232231
}
233-
if (path instanceof read_entry_js_1.ReadEntry) {
234-
this[ADDTARENTRY](path);
232+
if (typeof path === 'string') {
233+
this[ADDFSENTRY](path);
235234
}
236235
else {
237-
this[ADDFSENTRY](path);
236+
this[ADDTARENTRY](path);
238237
}
239238
return this.flowing;
240239
}

‎node_modules/tar/dist/commonjs/types.js‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,30 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
3-
exports.code = exports.name = exports.isName = exports.isCode = void 0;
3+
exports.code = exports.name = exports.normalFsTypes = exports.isName = exports.isCode = void 0;
44
const isCode = (c) => exports.name.has(c);
55
exports.isCode = isCode;
66
const isName = (c) => exports.code.has(c);
77
exports.isName = isName;
8+
/**
9+
* types that are a normal file system entry, not metadata.
10+
*
11+
* These can be the subject of extended/globalExtended headers, long path
12+
* names, long linkpath names, etc.
13+
*
14+
* Any other types are meta, and cannot be targetted by extended PAX headers.
15+
*/
16+
exports.normalFsTypes = new Set([
17+
'0',
18+
'',
19+
'1',
20+
'2',
21+
'3',
22+
'4',
23+
'5',
24+
'6',
25+
'7',
26+
'D',
27+
]);
828
// map types from key to human-friendly name
929
exports.name = new Map([
1030
['0', 'File'],

‎node_modules/tar/dist/esm/header.js‎

Lines changed: 51 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -42,22 +42,45 @@ export class Header {
4242
if (!buf || !(buf.length >= off + 512)) {
4343
throw new Error('need 512 bytes for header');
4444
}
45-
this.path = ex?.path ?? decString(buf, off, 100);
46-
this.mode = ex?.mode ?? gex?.mode ?? decNumber(buf, off + 100, 8);
47-
this.uid = ex?.uid ?? gex?.uid ?? decNumber(buf, off + 108, 8);
48-
this.gid = ex?.gid ?? gex?.gid ?? decNumber(buf, off + 116, 8);
49-
this.size = ex?.size ?? gex?.size ?? decNumber(buf, off + 124, 12);
50-
this.mtime = ex?.mtime ?? gex?.mtime ?? decDate(buf, off + 136, 12);
45+
// Decode the typeflag (independent of any pending PAX/GNU extended header)
46+
// up front so we can tell whether THIS block is itself an intermediary
47+
// extension header (PAX `x`/`g`, GNU long-name `L`, GNU long-link `K`).
48+
// Per POSIX pax, a PAX extended header describes the *next file entry*, not
49+
// the extension headers that may sit between it and that file. Applying the
50+
// pending PAX overrides (notably `size`) to an intervening `L`/`K`/`x`/`g`
51+
// header desynchronizes the stream relative to other tar implementations
52+
// and enables tar interpretation-conflict / file-smuggling attacks.
53+
const t = decString(buf, off + 156, 1);
54+
const isNormalFS = types.normalFsTypes.has(t);
55+
const exForFields = isNormalFS ? ex : undefined;
56+
const gexForFields = isNormalFS ? gex : undefined;
57+
this.path = exForFields?.path ?? decString(buf, off, 100);
58+
this.mode =
59+
exForFields?.mode ??
60+
gexForFields?.mode ??
61+
decNumber(buf, off + 100, 8);
62+
this.uid =
63+
exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8);
64+
this.gid =
65+
exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8);
66+
this.size =
67+
exForFields?.size ??
68+
gexForFields?.size ??
69+
decNumber(buf, off + 124, 12);
70+
this.mtime =
71+
exForFields?.mtime ??
72+
gexForFields?.mtime ??
73+
decDate(buf, off + 136, 12);
5174
this.cksum = decNumber(buf, off + 148, 12);
5275
// if we have extended or global extended headers, apply them now
5376
// See https://github.com/npm/node-tar/pull/187
54-
// Apply global before local, so it overrides
55-
if (gex)
56-
this.#slurp(gex, true);
57-
if (ex)
58-
this.#slurp(ex);
77+
// Apply global before local, so it overrides. Never slurp the pending
78+
// extended-header fields onto an intermediary extension header.
79+
if (gexForFields)
80+
this.#slurp(gexForFields, true);
81+
if (exForFields)
82+
this.#slurp(exForFields);
5983
// old tar versions marked dirs as a file with a trailing /
60-
const t = decString(buf, off + 156, 1);
6184
if (types.isCode(t)) {
6285
this.#type = t || '0';
6386
}
@@ -75,12 +98,24 @@ export class Header {
7598
this.linkpath = decString(buf, off + 157, 100);
7699
if (buf.subarray(off + 257, off + 265).toString() === 'ustar\u000000') {
77100
/* c8 ignore start */
78-
this.uname = ex?.uname ?? gex?.uname ?? decString(buf, off + 265, 32);
79-
this.gname = ex?.gname ?? gex?.gname ?? decString(buf, off + 297, 32);
101+
this.uname =
102+
exForFields?.uname ??
103+
gexForFields?.uname ??
104+
decString(buf, off + 265, 32);
105+
this.gname =
106+
exForFields?.gname ??
107+
gexForFields?.gname ??
108+
decString(buf, off + 297, 32);
80109
this.devmaj =
81-
ex?.devmaj ?? gex?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0;
110+
exForFields?.devmaj ??
111+
gexForFields?.devmaj ??
112+
decNumber(buf, off + 329, 8) ??
113+
0;
82114
this.devmin =
83-
ex?.devmin ?? gex?.devmin ?? decNumber(buf, off + 337, 8) ?? 0;
115+
exForFields?.devmin ??
116+
gexForFields?.devmin ??
117+
decNumber(buf, off + 337, 8) ??
118+
0;
84119
/* c8 ignore stop */
85120
if (buf[off + 475] !== 0) {
86121
// definitely a prefix, definitely >130 chars.

‎node_modules/tar/dist/esm/index.min.js‎

Lines changed: 3 additions & 3 deletions
Large diffs are not rendered by default.

‎node_modules/tar/dist/esm/pack.js‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,12 @@ export class PackJob {
2626
import { Minipass } from 'minipass';
2727
import * as zlib from 'minizlib';
2828
import { Yallist } from 'yallist';
29-
import { ReadEntry } from './read-entry.js';
3029
import { warnMethod } from './warn-method.js';
3130
const EOF = Buffer.alloc(1024);
3231
const ONSTAT = Symbol('onStat');
3332
const ENDED = Symbol('ended');
3433
const QUEUE = Symbol('queue');
35-
const PENDINGLINKS = Symbol('queue');
34+
const PENDINGLINKS = Symbol('pendingLinks');
3635
const CURRENT = Symbol('current');
3736
const PROCESS = Symbol('process');
3837
const PROCESSING = Symbol('processing');
@@ -190,11 +189,11 @@ export class Pack extends Minipass {
190189
if (this[ENDED]) {
191190
throw new Error('write after end');
192191
}
193-
if (path instanceof ReadEntry) {
194-
this[ADDTARENTRY](path);
192+
if (typeof path === 'string') {
193+
this[ADDFSENTRY](path);
195194
}
196195
else {
197-
this[ADDFSENTRY](path);
196+
this[ADDTARENTRY](path);
198197
}
199198
return this.flowing;
200199
}

‎node_modules/tar/dist/esm/types.js‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,25 @@
11
export const isCode = (c) => name.has(c);
22
export const isName = (c) => code.has(c);
3+
/**
4+
* types that are a normal file system entry, not metadata.
5+
*
6+
* These can be the subject of extended/globalExtended headers, long path
7+
* names, long linkpath names, etc.
8+
*
9+
* Any other types are meta, and cannot be targetted by extended PAX headers.
10+
*/
11+
export const normalFsTypes = new Set([
12+
'0',
13+
'',
14+
'1',
15+
'2',
16+
'3',
17+
'4',
18+
'5',
19+
'6',
20+
'7',
21+
'D',
22+
]);
323
// map types from key to human-friendly name
424
export const name = new Map([
525
['0', 'File'],

‎node_modules/tar/package.json‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"author": "Isaac Z. Schlueter",
33
"name": "tar",
44
"description": "tar for node",
5-
"version": "7.5.15",
5+
"version": "7.5.16",
66
"repository": {
77
"type": "git",
88
"url": "https://github.com/isaacs/node-tar.git"
@@ -31,20 +31,20 @@
3131
"yallist": "^5.0.0"
3232
},
3333
"devDependencies": {
34-
"@types/node": "^25.5.0",
34+
"@types/node": "^25.9.1",
3535
"chmodr": "^2.0.2",
3636
"end-of-stream": "^1.4.3",
37-
"esbuild": "^0.27.4",
37+
"esbuild": "^0.28.0",
3838
"events-to-array": "^2.0.3",
3939
"mutate-fs": "^2.1.1",
4040
"nock": "^13.5.4",
41-
"oxlint": "^1.57.0",
42-
"oxlint-tsgolint": "^0.17.3",
43-
"prettier": "^3.8.1",
41+
"oxlint": "^1.67.0",
42+
"oxlint-tsgolint": "^0.23.0",
43+
"prettier": "^3.8.3",
4444
"rimraf": "^6.1.2",
45-
"tap": "^21.6.2",
46-
"tshy": "^3.3.2",
47-
"typedoc": "^0.28.18"
45+
"tap": "^21.7.4",
46+
"tshy": "^4.1.2",
47+
"typedoc": "^0.28.19"
4848
},
4949
"license": "BlueOak-1.0.0",
5050
"engines": {
@@ -85,7 +85,8 @@
8585
"./header": "./src/header.ts",
8686
"./pax": "./src/pax.ts",
8787
"./types": "./src/types.ts"
88-
}
88+
},
89+
"selfLink": false
8990
},
9091
"exports": {
9192
"./package.json": "./package.json",

‎package-lock.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@
142142
"spdx-expression-parse": "^4.0.0",
143143
"ssri": "^13.0.1",
144144
"supports-color": "^10.2.2",
145-
"tar": "^7.5.15",
145+
"tar": "^7.5.16",
146146
"text-table": "~0.2.0",
147147
"tiny-relative-date": "^2.0.2",
148148
"treeverse": "^3.0.0",
@@ -13481,9 +13481,9 @@
1348113481
}
1348213482
},
1348313483
"node_modules/tar": {
13484-
"version": "7.5.15",
13485-
"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.15.tgz",
13486-
"integrity": "sha512-dzGK0boVlC4W5QFuQN1EFSl3bIDYsk7Tj40U6eIBnK2k/8ml7TZ5agbI5j5+qnoVcAA+rNtBml8SEiLxZpNqRQ==",
13484+
"version": "7.5.16",
13485+
"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
13486+
"integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
1348713487
"inBundle": true,
1348813488
"license": "BlueOak-1.0.0",
1348913489
"dependencies": {

0 commit comments

Comments
 (0)