(root: string, entryName: string)
| 33 | * writers refuse to emit `..` entries. |
| 34 | */ |
| 35 | export function resolveSafeTarget(root: string, entryName: string): string | null { |
| 36 | const absRoot = resolve(root); |
| 37 | const rootPrefix = absRoot + sep; |
| 38 | const rel = entryName.replaceAll('\\', '/'); |
| 39 | const target = resolve(absRoot, rel); |
| 40 | if (target !== absRoot && !target.startsWith(rootPrefix)) return null; |
| 41 | return target; |
| 42 | } |
| 43 | |
| 44 | /** |
| 45 | * Extract every file entry of `zipBuffer` under `destDir`, returning the list |
no test coverage detected