add test for sync unzipping a zip-slip attack file

Mostafa-Samir · Dec 30, 2021 · 949446a · 949446a
1 parent 6bb9b59
commit 949446a
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/tests/unzip.sync.test.js b/tests/unzip.sync.test.js
@@ -27,6 +27,13 @@ describe("Unzipping synchronously", function () {
         zipper.sync.unzip("./tests/assets/hello.zip").save("./tests/assets/hello-sync-unzip/");
     });
 
+    it("should raise an error when an entry is outside extraction path", function () {
+        fs.mkdirSync("./tests/assets/zip-slip-sync");
+        expect(
+            zipper.sync.unzip("./tests/assets/zip-slip.zip").save("./tests/assets/zip-slip-sync")
+        ).to.throw("Entry is outside the extraction path")
+    });
+
     it("checks if unzipped files on disk contain correct data", function (done) {
 
         fs.readFile("./tests/assets/hello-sync-unzip/hello/says-hello", 'utf8', function (err, data) {