INNER CODE UNIT · TypeScript

createTarGzFile

software-mansion/argent · packages/archive/src/index.ts:34

export async function createTarGzFile(sourcePath: string, tarPath: string): Promise<void> {
  try {
    await execFileAsync("tar", createTarGzArgs(sourcePath, tarPath));
  } catch (err) {
    await rm(tarPath, { force: true }).catch(() => {});
    throw err;
  }
}

function normalizeTarMemberPath(memberPath: string): string {
  return memberPath.replace(/^\.\//, "").replace(/\\/g, "/");
}

/** Reject tar-slip paths (absolute, `..`, or resolving outside `destDir`). */
function isSafeTarMember(memberPath: string, destDir: string): boolean {
  const normalized = normalizeTarMemberPath(memberPath);
  if (!normalized || normalized === "." || normalized === "./") return false;
  if (normalized.startsWith("/") || /^[A-Za-z]:[\\/]/.test(normalized)) return false;

View source record →