INNER CODE UNIT · TypeScript

listTarMembers

software-mansion/argent · packages/archive/src/index.ts:62

async function listTarMembers(tarPath: string): Promise<string[]> {
  const { stdout } = await execFileAsync("tar", ["-tzf", tarPath]);
  return stdout
    .split("\n")
    .map((line) => line.trim())
    .filter((line) => line.length > 0);
}

/** True when a symlink target would resolve outside the extract dir (absolute or `..`). */
function isEscapingLinkTarget(target: string): boolean {
  if (target.startsWith("/") || /^[A-Za-z]:[\\/]/.test(target)) return true;
  return posix.normalize(target.replace(/\\/g, "/")).split("/").includes("..");
}

/**
 * Reject members that could write or link outside `destDir`. Regular files and
 * directories pass; symlinks pass only when their target stays inside (a `.app`
 * carries internal ones like `Current -> A`); every other type (hardlink,

View source record →