Use unzip.Parse over unzip.Extract
#1666
Conversation
| new stream.Transform({ | ||
| objectMode: true, | ||
| transform: async (entry, _, callback) => { | ||
| const fullPath = path.normalize(path.join(directory, entry.path)) |
There was a problem hiding this comment.
const fullPath = path.resolve(directory, entry.path)
will path.resolve() be an better option, assume entry.path should be a relative path?
There was a problem hiding this comment.
That makes sense to me! I think download-artifact ensures that the path is absolute, but it doesn't look like toolkit does any validation.
There was a problem hiding this comment.
Ah, doing that throws off the check below for the directory path 😞
There was a problem hiding this comment.
Would you mind if I changed it back? On second thought, it might be better to keep this generic and not assume path for anyone utilizing this package. For download-artifact, we have the absolute path: https://github.com/actions/download-artifact/blob/348754975ef0295bfa2c111cba996120cfdf8a5d/src/download-artifact.ts#L38
There was a problem hiding this comment.
i thought directory is absolute path, looks like it can be relative...
There was a problem hiding this comment.
Directory is absolute when it comes from download-artifact, but isn't guaranteed absolute from other sources.
Co-authored-by: Tingluo Huang <tingluohuang@github.com>
| objectMode: true, | ||
| transform: async (entry, _, callback) => { | ||
| const fullPath = path.normalize(path.join(directory, entry.path)) | ||
| if (!directory.endsWith(path.sep)) { |
There was a problem hiding this comment.
It is important for the comparison below. Otherwise it will fail with, for example, "/tmp/dest/file".startsWith("../dest/")
|
Read
El jue., 29 de febrero de 2024 11:18 p. m., SpectruM <
***@***.***> escribió:
… ***@***.**** commented on this pull request.
[gh]
—
Reply to this email directly, view it on GitHub
<#1666 (review)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BEXBXBJNX6GVBPP2IQGWT7TYWAFQVAVCNFSM6AAAAABDVZDPF6VHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMYTSMJQGMZTMMZQGU>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
Updating our unzipping logic to use
unzip.Parseand handle theentryevent for greater control of the unzip process.