| 21 | } |
| 22 | |
| 23 | export async function extractZip(buffer: Buffer, destDir: string): Promise<string> { |
| 24 | await mkdir(destDir, { recursive: true }); |
| 25 | const destDirResolved = path.resolve(destDir); |
| 26 | let settled = false; |
| 27 | |
| 28 | await new Promise<void>((resolve, reject) => { |
| 29 | yauzlFromBuffer(buffer, { lazyEntries: true }, (openErr, zipfile) => { |
| 30 | if (openErr !== null || zipfile === undefined) { |
| 31 | reject(new Error(`Failed to open zip: ${openErr?.message ?? 'unknown error'}`)); |
| 32 | return; |
| 33 | } |
| 34 | |
| 35 | const onEntry = (entry: Entry): void => { |
| 36 | const fileName = entry.fileName; |
| 37 | const destPath = path.resolve(destDir, fileName); |
| 38 | |
| 39 | if (destPath !== destDirResolved && !destPath.startsWith(destDirResolved + path.sep)) { |
| 40 | if (!settled) { |
| 41 | settled = true; |
| 42 | reject(new Error(`Path traversal detected in zip entry: ${fileName}`)); |
| 43 | } |
| 44 | zipfile.close(); |
| 45 | return; |
| 46 | } |
| 47 | |
| 48 | if (fileName.endsWith('/')) { |
| 49 | mkdir(destPath, { recursive: true }) |
| 50 | .then(() => { |
| 51 | zipfile.readEntry(); |
| 52 | }) |
| 53 | .catch((error) => { |
| 54 | if (!settled) { |
| 55 | settled = true; |
| 56 | reject(error); |
| 57 | } |
| 58 | zipfile.close(); |
| 59 | }); |
| 60 | return; |
| 61 | } |
| 62 | |
| 63 | zipfile.openReadStream(entry, (streamErr, stream) => { |
| 64 | if (streamErr !== null || stream === undefined) { |
| 65 | if (!settled) { |
| 66 | settled = true; |
| 67 | reject( |
| 68 | new Error( |
| 69 | `Failed to read ${fileName} from archive: ${streamErr?.message ?? 'unknown error'}`, |
| 70 | ), |
| 71 | ); |
| 72 | } |
| 73 | zipfile.close(); |
| 74 | return; |
| 75 | } |
| 76 | |
| 77 | mkdir(path.dirname(destPath), { recursive: true }) |
| 78 | .then(() => pipeline(stream, createWriteStream(destPath))) |
| 79 | .then(() => restoreFilePermissions(destPath, entry)) |
| 80 | .then(() => { |