INNER CODE UNIT · TypeScript
normalizeTarMemberPath
software-mansion/argent · packages/archive/src/index.ts:43
function normalizeTarMemberPath(memberPath: string): string {
return memberPath.replace(/^\.\//, "").replace(/\\/g, "/");
}
/** Reject tar-slip paths (absolute, `..`, or resolving outside `destDir`). */
function isSafeTarMember(memberPath: string, destDir: string): boolean {
const normalized = normalizeTarMemberPath(memberPath);
if (!normalized || normalized === "." || normalized === "./") return false;
if (normalized.startsWith("/") || /^[A-Za-z]:[\\/]/.test(normalized)) return false;
const relative = posix.normalize(normalized);
if (relative === ".." || relative.startsWith("../") || relative.split("/").includes("..")) {
return false;
}
const root = resolve(destDir);
const resolved = resolve(destDir, relative);
return resolved === root || resolved.startsWith(root + sep);
}