fix: don't fail on malformed tar headers (#6674)

close #5362
pnpm · Jun 14, 2023 · e57e2d3 · e57e2d3
1 parent b9ffc28
commit e57e2d3
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 1 deletion.
diff --git a/.changeset/orange-garlics-compete.md b/.changeset/orange-garlics-compete.md
@@ -0,0 +1,6 @@
+---
+"@pnpm/cafs": patch
+"pnpm": patch
+---
+
+Don't fail when a package is archived in a tarball with malformed tar headers [#5362](https://github.com/pnpm/pnpm/issues/5362).
diff --git a/store/cafs/src/addFilesFromTarball.ts b/store/cafs/src/addFilesFromTarball.ts
@@ -11,7 +11,7 @@ export async function addFilesFromTarball (
   manifest?: DeferredManifestPromise
 ): Promise<FilesIndex> {
   const ignore = _ignore ?? (() => false)
-  const extract = tar.extract()
+  const extract = tar.extract({ allowUnknownFormat: true })
   const filesIndex: FilesIndex = {}
   await new Promise<void>((resolve, reject) => {
     extract.on('entry', (header, fileStream, next) => {

diff --git a/store/cafs/test/fixtures/jquery.dirtyforms-2.0.0.tgz b/store/cafs/test/fixtures/jquery.dirtyforms-2.0.0.tgz
diff --git a/store/cafs/test/index.ts b/store/cafs/test/index.ts
@@ -74,3 +74,11 @@ test('file names are normalized when unpacking a tarball', async () => {
     'package.json',
   ])
 })
+
+test('broken magic in tarball headers is handled gracefully', async () => {
+  const dest = tempy.directory()
+  const cafs = createCafs(dest)
+  await cafs.addFilesFromTarball(
+    createReadStream(path.join(__dirname, 'fixtures/jquery.dirtyforms-2.0.0.tgz'))
+  )
+})