INNER CODE UNIT · TypeScript
assertSafeMemberTypes
software-mansion/argent · packages/archive/src/index.ts:83
async function assertSafeMemberTypes(tarPath: string): Promise<void> {
const { stdout } = await execFileAsync("tar", ["-tzvf", tarPath]);
for (const line of stdout.split("\n")) {
if (!line.trim()) continue;
const type = line[0];
if (type === "-" || type === "d") continue; // regular file or directory
if (type === "l") {
// More than one ` -> ` means the name or target itself contains it, so
// the real target can't be read — refuse rather than trust a name like
// `x -> safe` that hides an escaping target.
const parts = line.split(" -> ");
const target = parts.length === 2 ? parts[1]!.trim() : "";
if (parts.length !== 2 || !target || isEscapingLinkTarget(target)) {
throw new ArchiveError(
`Archive contains a symlink whose target could not be confirmed safe: "${line.trim()}".`
);
}
continue;