port fix from main

mafintosh · mafintosh · commit df4bca54402e · 2025-01-12T12:13:48.000+01:00
diff --git a/index.js b/index.js
@@ -254,6 +254,8 @@ exports.extract = function (cwd, opts) {
     var onsymlink = function () {
       if (win32) return next() // skip symlinks on win for now before it can be tested
       xfs.unlink(name, function () {
+        var dst = path.resolve(path.dirname(name), header.linkname)
+        if (!dst.startsWith(path.resolve(cwd))) return next(new Error(name + ' is not a valid symlink'))
         xfs.symlink(header.linkname, name, stat)
       })
     }
diff --git a/test/index.js b/test/index.js
@@ -304,7 +304,7 @@ test('do not extract invalid tar', function (t) {
   fs.createReadStream(a)
     .pipe(tar.extract(out))
     .on('error', function (err) {
-      t.ok(/is not a valid path/i.test(err.message))
+      t.ok(/is not a valid symlink/i.test(err.message))
       fs.stat(path.join(out, '../bar'), function (err) {
         t.ok(err)
         t.end()

Original file line number	Diff line number	Diff line change
`@@ -254,6 +254,8 @@ exports.extract = function (cwd, opts) {`
`254`	`254`	`var onsymlink = function () {`
`255`	`255`	`if (win32) return next() // skip symlinks on win for now before it can be tested`
`256`	`256`	`xfs.unlink(name, function () {`
	`257`	`+ var dst = path.resolve(path.dirname(name), header.linkname)`
	`258`	`+ if (!dst.startsWith(path.resolve(cwd))) return next(new Error(name + ' is not a valid symlink'))`
`257`	`259`	`xfs.symlink(header.linkname, name, stat)`
`258`	`260`	`})`
`259`	`261`	`}`