mirror/pnpm

0 Fork 0

mirror of https://github.com/pnpm/pnpm.git synced 2026-10-12 05:04:40 -04:00

Files

T

Zoltan Kochan dced54c4ba test(binary-fetcher): fix symlink assertions in TS CI (#14936 )

The binary-fetcher symlink tests still named the removed adm-zip 0.6.0 patch and required its custom error message. Current adm-zip rejects those paths with a file-in-the-way error, so the tests failed despite preventing an outside-file overwrite. Check for that destination-path rejection and preserve the outside-file assertion, without coupling the tests to the removed patch's message.

2026-09-16 01:39:23 +02:00

scripts

…

src

fix(binary-fetcher): unpack zip archives into a random directory (#14733 )

2026-09-09 15:02:57 +02:00

test

test(binary-fetcher): fix symlink assertions in TS CI (#14936 )

2026-09-16 01:39:23 +02:00

package.json

chore(release): 11.27.0 (#14856 )

2026-09-12 12:01:04 +02:00

README.md

…

tsconfig.json

…

tsconfig.lint.json

…

README.md

@pnpm/fetching.binary-fetcher

A fetcher for binary archives

Installation

pnpm add @pnpm/fetching.binary-fetcher

Testing

Test Fixtures

The test/fixtures/ directory contains malicious ZIP files for testing path traversal protection:

File	Entry Path	Purpose
`path-traversal.zip`	`../../../.npmrc`	Tests `../` escape sequences
`absolute-path.zip`	`/etc/passwd`	Tests absolute path entries
`backslash-traversal.zip`	`..\..\..\evil.txt`	Tests Windows backslash traversal (Windows-only)

These fixtures are manually crafted because AdmZip's addFile() sanitizes paths automatically.

Note: The backslash test only runs on Windows because \ is a valid filename character on Unix.

Regenerating Fixtures

node --experimental-strip-types scripts/create-fixtures.ts

License

MIT