Files
codeql/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/TarSlipBad.js
Erik Krogh Kristensen 4175d36269 add test case
2020-05-14 09:46:54 +02:00

24 lines
459 B
JavaScript

const fs = require('fs');
const tar = require('tar-stream');
const extract = tar.extract();
extract.on('entry', (header, stream, next) => {
const out = fs.createWriteStream(header.name);
if (header.linkname) {
fs.linkSync(header.linkname, "foo");
}
stream.pipe(out);
stream.on('end', () => {
next();
})
stream.resume();
})
extract.on('finish', () => {
console.log('finished');
});
fs.createReadStream('./bad.tar').pipe(extract);