Appease GHAS

desktop · Oct 22, 2024 · 0554c65 · 0554c65
1 parent 943ea99
commit 0554c65
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/script/download-git.js b/script/download-git.js
@@ -47,6 +47,9 @@ const unpackFile = file =>
       .pipe(new createGunzip())
       .pipe(extract())
       .on('entry', ({ type, name, mode, linkname }, stream, next) => {
+        if (name.includes('..')) {
+          throw new Error(`invalid file name: ${name}`)
+        }
         const p = resolvePath(config.outputPath, name)
         assert.ok(p.startsWith(config.outputPath))
         if (type === 'file') {