@@ -25,7 +25,7 @@ import { createServer } from "node:http";
|
25 | 25 | import { createConnection as createNetConnection, createServer as createNetServer } from "node:net"; |
26 | 26 | import type { Socket } from "node:net"; |
27 | 27 | import { tmpdir } from "node:os"; |
28 | | -import { dirname, join, relative, resolve, win32 as pathWin32 } from "node:path"; |
| 28 | +import { basename, dirname, join, relative, resolve, win32 as pathWin32 } from "node:path"; |
29 | 29 | import { fileURLToPath, pathToFileURL } from "node:url"; |
30 | 30 | import { isLocalBuildMetadataDistPath } from "./lib/local-build-metadata-paths.mjs"; |
31 | 31 | import { buildCmdExeCommandLine } from "./windows-cmd-helpers.mjs"; |
@@ -180,6 +180,19 @@ export const CROSS_OS_COMMAND_HEARTBEAT_SECONDS = parsePositiveIntegerEnv(
|
180 | 180 | 60, |
181 | 181 | ); |
182 | 182 | |
| 183 | +export function resolveNpmPackTarballFileName(value, label = "npm pack") { |
| 184 | +const filename = typeof value === "string" ? value.trim() : ""; |
| 185 | +if ( |
| 186 | +!filename.endsWith(".tgz") || |
| 187 | +filename.includes("\0") || |
| 188 | +filename !== basename(filename) || |
| 189 | +filename !== pathWin32.basename(filename) |
| 190 | +) { |
| 191 | +throw new Error(`${label} did not report a safe .tgz filename.`); |
| 192 | +} |
| 193 | +return filename; |
| 194 | +} |
| 195 | + |
183 | 196 | if (isMainModule()) { |
184 | 197 | try { |
185 | 198 | await main(process.argv.slice(2)); |
@@ -668,16 +681,14 @@ async function prepareCandidate(params) {
|
668 | 681 | writeFileSync(packJsonPath, packResult.stdout, "utf8"); |
669 | 682 | const parsedPack = JSON.parse(packResult.stdout); |
670 | 683 | const lastPack = Array.isArray(parsedPack) ? parsedPack.at(-1) : null; |
671 | | -if (!lastPack?.filename) { |
672 | | -throw new Error("npm pack did not report a filename."); |
673 | | -} |
| 684 | +const packFilename = resolveNpmPackTarballFileName(lastPack?.filename); |
674 | 685 | |
675 | 686 | return { |
676 | 687 | sourceDir: params.sourceDir, |
677 | 688 | sourceSha, |
678 | 689 | candidateVersion: String(lastPack.version ?? packageJson.version ?? "").trim(), |
679 | | -candidateTgz: join(packDir, lastPack.filename), |
680 | | -candidateFileName: String(lastPack.filename).trim(), |
| 690 | +candidateTgz: join(packDir, packFilename), |
| 691 | +candidateFileName: packFilename, |
681 | 692 | }; |
682 | 693 | } |
683 | 694 | |
|