mirror/pnpm

0 Fork 0

mirror of https://github.com/pnpm/pnpm.git synced 2026-09-16 08:32:45 -04:00

Files

T

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

2026-07-29 09:29:53 +02:00

2026-06-20 14:36:25 +02:00

2026-06-20 14:36:25 +02:00

2026-06-20 14:36:25 +02:00

package.json

2026-07-29 09:29:53 +02:00

README.md

2026-06-20 14:36:25 +02:00

tsconfig.json

2026-06-20 14:36:25 +02:00

tsconfig.lint.json

2026-06-20 14:36:25 +02:00

@pnpm/fetching.binary-fetcher

A fetcher for binary archives

Installation

pnpm add @pnpm/fetching.binary-fetcher

The test/fixtures/ directory contains malicious ZIP files for testing path traversal protection:

File	Entry Path	Purpose
`path-traversal.zip`	`../../../.npmrc`	Tests `../` escape sequences
`absolute-path.zip`	`/etc/passwd`	Tests absolute path entries
`backslash-traversal.zip`	`..\..\..\evil.txt`	Tests Windows backslash traversal (Windows-only)

These fixtures are manually crafted because AdmZip's addFile() sanitizes paths automatically.

Note: The backslash test only runs on Windows because \ is a valid filename character on Unix.

node --experimental-strip-types scripts/create-fixtures.ts

MIT