mirror of https://github.com/pnpm/pnpm.git synced 2026-03-27 11:31:45 -04:00

Files

Brandon Cheng 01914345d5 build: enable @typescript-eslint/no-import-type-side-effects (#10630 )

* build: enable `@typescript-eslint/no-import-type-side-effects`

* build: disable `@typescript-eslint/consistent-type-imports`

* chore: apply fixes for `no-import-type-side-effects`

pnpm exec eslint "**/src/**/*.ts" "**/test/**/*.ts" --fix

2026-03-08 00:02:48 +01:00

scripts

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

src

build: enable @typescript-eslint/no-import-type-side-effects (#10630 )

2026-03-08 00:02:48 +01:00

test

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

CHANGELOG.md

chore(release): 10.19.0

2025-10-21 15:30:20 +02:00

package.json

feat: use SQLite for storing package index in the content-addressable store (#10827 )

2026-03-06 12:59:04 +01:00

README.md

fix: prevent path traversal vulnerabilities during ZIP extraction

2026-01-16 20:36:40 +01:00

tsconfig.json

feat: use SQLite for storing package index in the content-addressable store (#10827 )

2026-03-06 12:59:04 +01:00

tsconfig.lint.json

feat: support installing Deno runtime (#9791 )

2025-07-30 11:27:07 +02:00

README.md

@pnpm/fetching.binary-fetcher

A fetcher for binary archives

Installation

pnpm add @pnpm/fetching.binary-fetcher

Testing

Test Fixtures

The test/fixtures/ directory contains malicious ZIP files for testing path traversal protection:

File	Entry Path	Purpose
`path-traversal.zip`	`../../../.npmrc`	Tests `../` escape sequences
`absolute-path.zip`	`/etc/passwd`	Tests absolute path entries
`backslash-traversal.zip`	`..\..\..\evil.txt`	Tests Windows backslash traversal (Windows-only)

These fixtures are manually crafted because AdmZip's addFile() sanitizes paths automatically.

Note: The backslash test only runs on Windows because \ is a valid filename character on Unix.

Regenerating Fixtures

node --experimental-strip-types scripts/create-fixtures.ts

License

MIT