tar@2.1.0

* properly error on malformed tar files
* use fromBase property to set extraction root

8 files changed, 72 insertions, 34 deletions

diff --git a/node_modules/tar/README.md b/node_modules/tar/README.md
index 424a2782b..cfda2ac18 100644
--- a/node_modules/tar/README.md
+++ b/node_modules/tar/README.md
@@ -22,7 +22,9 @@ stream.
 This only works with directories, it does not work with individual files.
 
 The optional `properties` object are used to set properties in the tar
-'Global Extended Header'.
+'Global Extended Header'. If the `fromBase` property is set to true,
+the tar will contain files relative to the path passed, and not with
+the path included.
 
 ### tar.Extract([options])
 
diff --git a/node_modules/tar/lib/extract.js b/node_modules/tar/lib/extract.js
index 5a4cb98c3..fe1bb976e 100644
--- a/node_modules/tar/lib/extract.js
+++ b/node_modules/tar/lib/extract.js
@@ -88,7 +88,7 @@ inherits(Extract, tar.Parse)
 
 Extract.prototype._streamEnd = function () {
   var me = this
-  if (!me._ended) me.error("unexpected eof")
+  if (!me._ended || me._entry) me.error("unexpected eof")
   me._fst.end()
   // my .end() is coming later.
 }
diff --git a/node_modules/tar/lib/pack.js b/node_modules/tar/lib/pack.js
index 3ff14dd69..5a3bb95a1 100644
--- a/node_modules/tar/lib/pack.js
+++ b/node_modules/tar/lib/pack.js
@@ -131,7 +131,12 @@ Pack.prototype._process = function () {
   // in the tarball to use.  That way we can skip a lot of extra
   // work when resolving symlinks for bundled dependencies in npm.
 
-  var root = path.dirname((entry.root || entry).path)
+  var root = path.dirname((entry.root || entry).path);
+  if (me._global && me._global.fromBase && entry.root && entry.root.path) {
+    // user set 'fromBase: true' indicating tar root should be directory itself
+    root = entry.root.path;
+  }
+
   var wprops = {}
 
   Object.keys(entry.props || {}).forEach(function (k) {
diff --git a/node_modules/tar/lib/parse.js b/node_modules/tar/lib/parse.js
index 8517c481b..1c53d9d26 100644
--- a/node_modules/tar/lib/parse.js
+++ b/node_modules/tar/lib/parse.js
@@ -61,7 +61,7 @@ function Parse () {
 // emitting "end"
 Parse.prototype._streamEnd = function () {
   var me = this
-  if (!me._ended) me.error("unexpected eof")
+  if (!me._ended || me._entry) me.error("unexpected eof")
   me.emit("end")
 }
 
diff --git a/node_modules/tar/package.json b/node_modules/tar/package.json
index ec4d2d379..5483bf346 100644
--- a/node_modules/tar/package.json
+++ b/node_modules/tar/package.json
@@ -6,7 +6,7 @@
   },
   "name": "tar",
   "description": "tar for node",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "repository": {
     "type": "git",
     "url": "git://github.com/isaacs/node-tar.git"
@@ -27,34 +27,14 @@
     "mkdirp": "^0.5.0"
   },
   "license": "BSD",
-  "gitHead": "ce405d0b96f0fe186dd4cc68d666fabb0c59818d",
+  "readme": "# node-tar\n\nTar for Node.js.\n\n[![NPM](https://nodei.co/npm/tar.png)](https://nodei.co/npm/tar/)\n\n## API\n\nSee `examples/` for usage examples.\n\n### var tar = require('tar')\n\nReturns an object with `.Pack`, `.Extract` and `.Parse` methods.\n\n### tar.Pack([properties])\n\nReturns a through stream. Use\n[fstream](https://npmjs.org/package/fstream) to write files into the\npack stream and you will receive tar archive data from the pack\nstream.\n\nThis only works with directories, it does not work with individual files.\n\nThe optional `properties` object are used to set properties in the tar\n'Global Extended Header'. If the `fromBase` property is set to true,\nthe tar will contain files relative to the path passed, and not with\nthe path included.\n\n### tar.Extract([options])\n\nReturns a through stream. Write tar data to the stream and the files\nin the tarball will be extracted onto the filesystem.\n\n`options` can be:\n\n```js\n{\n  path: '/path/to/extract/tar/into',\n  strip: 0, // how many path segments to strip from the root when extracting\n}\n```\n\n`options` also get passed to the `fstream.Writer` instance that `tar`\nuses internally.\n\n### tar.Parse()\n\nReturns a writable stream. Write tar data to it and it will emit\n`entry` events for each entry parsed from the tarball. This is used by\n`tar.Extract`.\n",
+  "readmeFilename": "README.md",
+  "gitHead": "b4c03a8e922fa522a3ddadaf2764bc1ab38d484e",
   "bugs": {
     "url": "https://github.com/isaacs/node-tar/issues"
   },
-  "homepage": "https://github.com/isaacs/node-tar",
-  "_id": "tar@2.0.1",
-  "_shasum": "a1537ab0d1ce61462ce87b4eed1cd263fba5fc17",
-  "_from": "tar@>=2.0.1 <2.1.0",
-  "_npmVersion": "2.7.6",
-  "_nodeVersion": "1.4.2",
-  "_npmUser": {
-    "name": "isaacs",
-    "email": "i@izs.me"
-  },
-  "maintainers": [
-    {
-      "name": "isaacs",
-      "email": "i@izs.me"
-    },
-    {
-      "name": "othiym23",
-      "email": "ogd@aoaioxxysz.net"
-    }
-  ],
-  "dist": {
-    "shasum": "a1537ab0d1ce61462ce87b4eed1cd263fba5fc17",
-    "tarball": "http://registry.npmjs.org/tar/-/tar-2.0.1.tgz"
-  },
-  "directories": {},
-  "_resolved": "https://registry.npmjs.org/tar/-/tar-2.0.1.tgz"
+  "homepage": "https://github.com/isaacs/node-tar#readme",
+  "_id": "tar@2.1.0",
+  "_shasum": "d287aad12e947c766e319ac364f3c234900f65ec",
+  "_from": "tar@>=2.1.0 <2.2.0"
 }
diff --git a/node_modules/tar/test/cb-never-called-1.0.1.tgz b/node_modules/tar/test/cb-never-called-1.0.1.tgz
new file mode 100644
index 000000000..9e7014d85
--- /dev/null
+++ b/node_modules/tar/test/cb-never-called-1.0.1.tgz
diff --git a/node_modules/tar/test/error-on-broken.js b/node_modules/tar/test/error-on-broken.js
new file mode 100644
index 000000000..e484920fd
--- /dev/null
+++ b/node_modules/tar/test/error-on-broken.js
@@ -0,0 +1,33 @@
+var fs = require('fs')
+var path = require('path')
+var zlib = require('zlib')
+
+var tap = require('tap')
+
+var tar = require('../tar.js')
+
+var file = path.join(__dirname, 'cb-never-called-1.0.1.tgz')
+var target = path.join(__dirname, 'tmp/extract-test')
+
+tap.test('preclean', function (t) {
+  require('rimraf').sync(__dirname + '/tmp/extract-test')
+  t.pass('cleaned!')
+  t.end()
+})
+
+tap.test('extract test', function (t) {
+  var extract = tar.Extract(target)
+  var inp = fs.createReadStream(file)
+
+  inp.pipe(zlib.createGunzip()).pipe(extract)
+
+  extract.on('error', function (er) {
+    t.equal(er.message, 'unexpected eof', 'error noticed')
+    t.end()
+  })
+
+  extract.on('end', function () {
+    t.fail('shouldn\'t reach this point due to errors')
+    t.end()
+  })
+})
diff --git a/node_modules/tar/test/pack.js b/node_modules/tar/test/pack.js
index bf033c129..0f16c07bb 100644
--- a/node_modules/tar/test/pack.js
+++ b/node_modules/tar/test/pack.js
@@ -830,6 +830,10 @@ tap.test("without global header", { timeout: 10000 }, function (t) {
   runTest(t, false)
 })
 
+tap.test("with from base", { timeout: 10000 }, function (t) {
+  runTest(t, true, true)
+})
+
 function alphasort (a, b) {
   return a === b ? 0
        : a.toLowerCase() > b.toLowerCase() ? 1
@@ -839,7 +843,7 @@ function alphasort (a, b) {
 }
 
 
-function runTest (t, doGH) {
+function runTest (t, doGH, doFromBase) {
   var reader = Reader({ path: input
                       , filter: function () {
                           return !this.path.match(/\.(tar|hex)$/)
@@ -847,7 +851,10 @@ function runTest (t, doGH) {
                       , sort: alphasort
                       })
 
-  var pack = Pack(doGH ? pkg : null)
+  var props = doGH ? pkg : {}
+  if(doFromBase) props.fromBase = true;
+
+  var pack = Pack(props)
   var writer = Writer(target)
 
   // skip the global header if we're not doing that.
@@ -901,6 +908,17 @@ function runTest (t, doGH) {
     }
     t.equal(ev, wanted[0], "event type should be "+wanted[0])
 
+    if(doFromBase) {
+      if(wanted[1].path.indexOf('fixtures/') && wanted[1].path.length == 100)
+        wanted[1].path = wanted[1].path.replace('fixtures/', '') + 'ccccccccc'
+
+      if(wanted[1]) wanted[1].path = wanted[1].path.replace('fixtures/', '').replace('//', '/')
+      if(wanted[1].path == '') wanted[1].path = '/'
+      if(wanted[2] && wanted[2].path) wanted[2].path = wanted[2].path.replace('fixtures', '').replace(/^\//, '')
+
+      wanted[1].linkpath = wanted[1].linkpath.replace('fixtures/', '')
+    }
+
     if (ev !== wanted[0] || e.path !== wanted[1].path) {
       console.error("wanted", wanted)
       console.error([ev, e.props])