INNER CODE UNIT · TypeScript
isEscapingLinkTarget
software-mansion/argent · packages/archive/src/index.ts:71
function isEscapingLinkTarget(target: string): boolean {
if (target.startsWith("/") || /^[A-Za-z]:[\\/]/.test(target)) return true;
return posix.normalize(target.replace(/\\/g, "/")).split("/").includes("..");
}
/**
* Reject members that could write or link outside `destDir`. Regular files and
* directories pass; symlinks pass only when their target stays inside (a `.app`
* carries internal ones like `Current -> A`); every other type (hardlink,
* device, fifo, …) is refused. Only `tar -tzvf`'s type char and ` -> <target>`
* are read — the column-formatted name is not stable across tar variants.
*/
async function assertSafeMemberTypes(tarPath: string): Promise<void> {
const { stdout } = await execFileAsync("tar", ["-tzvf", tarPath]);
for (const line of stdout.split("\n")) {
if (!line.trim()) continue;
const type = line[0];
if (type === "-" || type === "d") continue; // regular file or directory