kevva / decompress-tar Goto Github PK

View Code? Open in Web Editor NEW

16.0 10.0 17.0 38 KB

tar plugin for decompress

License: MIT License

JavaScript 100.00%

decompress-tar's Introduction

decompress-tar

tar decompress plugin

Install

$ npm install decompress-tar

Usage

const decompress = require('decompress');
const decompressTar = require('decompress-tar');

decompress('unicorn.tar', 'dist', {
	plugins: [
		decompressTar()
	]
}).then(() => {
	console.log('Files decompressed');
});

API

decompressTar()(input)

Returns both a Promise for a Buffer and a Duplex stream.

input

Type: Buffer Stream

Buffer or stream to decompress.

License

MIT © Kevin Mårtensson

decompress-tar's People

Contributors

Stargazers

Watchers

Forkers

sorrycc guy-mograbi-at-gigaspaces piranna xflofoxx realityking dumytrashchuk jkroepke nicolastroles evanvosberg dchambers xingrz starke neko7sora xhmikosr vitaly-z benallfree brunnjf

decompress-tar's Issues

./configure: Permission denied for bad archives

I had error like when install optipng-bin module

/bin/sh: ./configure: Permission denied

I spent some time and found where is the problem:

When I add new module which use bin-builds it`s try to download and install some tar.gz file from sourceforge.net
But sourceforge.net had some maitenance issues at that moment and return some html instead tar.gz file which download module store as filename.tar.gz
Then decompress-tar return empty files list to decompress-targz and last pass this list to decompress
bin-builts think thats all right and try to execute autoconf and failed.

I think must be test for this situation. But I do not sure in which module:

decompress
decompress-tar
download
bin-build
tar-stream

Detected Vulnerability requires fix

Hello, there is a vulnerability detected by Snyk that is affecting other packages using this one (like decompress ).
https://security.snyk.io/package/npm/decompress-tar

Is there any chance to fix it or suggest a solution? Thanks

Snyk vulnerability found in version 4.1.1

Snyk reports a security vulnerability in the last version of the package.
https://snyk.io/test/npm/decompress-tar/4.1.1

Please raise tar-stream dependency version

Hello,

could you please raise the tar-stream dependency to latest 2.x version to get rid of the vulnerable bl package (CVE-2020-8244).

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1 and <2.2.1 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Please also release a new version.

Thanks,
Gregor

Add transpiler support

This module can't be used directly because it does not use a transpiler.

status of this project?

Looks like the last commit was in 2017. Is this project still maintained or should it be considered EOL?

How to fix decompress-tar vulnerability

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.

It's not decompressing symlinks

I have problems decompressing Linux kernel because symlinks like https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/arch/arm/boot/dts/include/dt-bindings?id=refs/tags/v4.3.3 are converted to empty files. I've found that we are not filling the linkpath field nor the symlink type, that probably that's the reason why it's not working.

can CVE-2020-12265 be closed with decompress-4.2.1?

how to prove decompress-4.2.1 is not vulnerable?