Function extractZip

apps/vis/server/src/lib/zip-import.ts:49–118

(
  zipBuffer: Buffer,
  destDir: string,
  options: ExtractOptions = {},
)

 * safe, caller-owned directory; this function never writes outside it.
 */
export async function extractZip(
  zipBuffer: Buffer,
  destDir: string,
  options: ExtractOptions = {},
): Promise<string[]> {
  const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
  const maxTotalBytes = options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;
  const root = resolve(destDir);

  const zip = await openZip(zipBuffer);
  const written: string[] = [];
  let entryCount = 0;
  let totalBytes = 0;

  return new Promise<string[]>((resolvePromise, reject) => {
    const fail = (message: string): void => {
      zip.close();
      reject(new ZipImportError(message));
    };

    zip.readEntry();
    zip.on('entry', (entry: Entry) => {
      entryCount += 1;
      if (entryCount > maxEntries) {
        fail(`zip has too many entries (> ${maxEntries})`);
        return;
      }
      totalBytes += entry.uncompressedSize;
      if (totalBytes > maxTotalBytes) {
        fail(`zip uncompressed size exceeds ${maxTotalBytes} bytes`);
        return;
      }

      // Directory entries end with '/'. Files inside still create their dirs.
      if (entry.fileName.endsWith('/')) {
        zip.readEntry();
        return;
      }

      const rel = entry.fileName.replaceAll('\\', '/');
      const target = resolveSafeTarget(root, rel);
      if (target === null) {
        fail(`zip entry escapes the import directory: "${entry.fileName}"`);
        return;
      }

      zip.openReadStream(entry, (err, readStream) => {
        if (err !== null || readStream === undefined) {
          fail(`failed to read zip entry "${entry.fileName}": ${err?.message ?? 'unknown'}`);
          return;
        }
        void mkdir(dirname(target), { recursive: true })
          .then(() => pipeline(readStream, createWriteStream(target)))
          .then(() => {
            written.push(rel);
            zip.readEntry();
          })
          .catch((error: unknown) => {