Files
codeql/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/TarSlipBad.js

19 lines
387 B
JavaScript

const fs = require('fs');
const tar = require('tar-stream');
const extract = tar.extract();
extract.on('entry', (header, stream, next) => {
const out = fs.createWriteStream(header.name);
stream.pipe(out);
stream.on('end', () => {
next();
})
stream.resume();
})
extract.on('finish', () => {
console.log('finished');
});
fs.createReadStream('./bad.tar').pipe(extract);