fix(release): keep plugin pack filenames local · openclaw/openclaw@5c74fde
vincentkoc
·
2026-06-17
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -278,6 +278,23 @@ describe("resolveNpmPackFilename", () => {
|
278 | 278 | |
279 | 279 | expect(resolveNpmPackFilename(noisyOutput)).toBe("openclaw-msteams-2026.5.24-beta.1.tgz"); |
280 | 280 | }); |
| 281 | + |
| 282 | +it("rejects path-like tarball output instead of reading outside the pack directory", () => { |
| 283 | +const unsafeOutputs = [ |
| 284 | +"../openclaw-msteams.tgz", |
| 285 | +"nested/openclaw-msteams.tgz", |
| 286 | +"nested\\openclaw-msteams.tgz", |
| 287 | +"/tmp/openclaw-msteams.tgz", |
| 288 | +"C:\\temp\\openclaw-msteams.tgz", |
| 289 | +"openclaw-msteams\u0000.tgz", |
| 290 | +]; |
| 291 | + |
| 292 | +for (const output of unsafeOutputs) { |
| 293 | +expect(() => resolveNpmPackFilename(output)).toThrow( |
| 294 | +"npm pack did not report a tarball filename", |
| 295 | +); |
| 296 | +} |
| 297 | +}); |
281 | 298 | }); |
282 | 299 | |
283 | 300 | describe("findPackedPackageReadmePath", () => { |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
