Merge pull request #93 from codefresh-io/CR-14111

fixing vulnerabilities

Author: roi-codefresh

lib/logic/Spwan.helper.js

@@ -1,20 +1,69 @@
 const fs = require('fs');
 const { resolve, join } = require('path');
 const { homedir, arch } = require('os');
+let { pipeline } = require('stream');
+const { createGunzip } = require('zlib');
+const { promisify } = require('util');
 
 const _ = require('lodash');
 const rp = require('request-promise');
 const request = require('request');
-const decompress = require('decompress');
-const decompressTargz = require('decompress-targz');
-const decompressUnzip = require('decompress-unzip');
+const tarStream = require('tar-stream');
+const zip = require('zip');
 const compareVersions = require('compare-versions');
 
+pipeline = promisify(pipeline);
+
 const CODEFRESH_PATH = resolve(homedir(), '.Codefresh');
 
+async function unzipFile(zipPath, outputPath) {
+    const zipBuffer = await fs.promises.readFile(zipPath);
+    const zr = zip.Reader(zipBuffer);
+
+    const fileWrites = [];
+    zr.forEach((entry) => {
+        if (!entry.isFile()) {
+            return;
+        }
+
+        const outputFilePath = join(outputPath, entry.getName());
+        fileWrites.push(fs.promises.writeFile(outputFilePath, entry.getData(), { mode: entry.getMode() }));
+    });
+
+    return Promise.all(fileWrites);
+}
+
+async function untarFile(tarPath, outputPath) {
+    const zipFile = fs.createReadStream(tarPath);
+    const unzipStream = createGunzip();
+    const extract = tarStream.extract();
+
+    extract.on('entry', async (headers, stream, next) => {
+        if (headers.type !== 'file') {
+            return next();
+        }
+
+        try {
+            const outputFilePath = join(outputPath, headers.name);
+            const outputFile = fs.createWriteStream(outputFilePath, { mode: headers.mode });
+            await pipeline(stream, outputFile);
+            return next();
+        } catch (error) {
+            return next(error);
+        }
+    });
+
+    await pipeline(
+        zipFile,
+        unzipStream,
+        extract,
+    );
+}
+
 const prepareSpwan = async ({ name, repoName, pathName, branch = 'master', excludeVersionPrefix = false, events }) => {
     const dirPath = join(CODEFRESH_PATH, name);
     const versionPath = join(CODEFRESH_PATH, name, 'version.txt');
+    const outputPath = join(CODEFRESH_PATH, name);
     const filePath = join(CODEFRESH_PATH, name, repoName);
     const fullPath = pathName ? join(repoName, branch, pathName) : join(repoName, branch);
     const versionUrl = `https://raw.githubusercontent.com/codefresh-io/${fullPath}/VERSION`;
@@ -70,25 +119,15 @@ const prepareSpwan = async ({ name, repoName, pathName, branch = 'master', exclu
             });
         }
 
-        req.pipe(fs.createWriteStream(zipPath));
-        const p = new Promise((resolveFn, rejectFn) => {
-            req.on('end', () => {
-                decompress(zipPath, join(homedir(), '.Codefresh', name), {
-                    plugins: [
-                        decompressTargz(),
-                        decompressUnzip(),
-                    ],
-                }).then(() => {
-                    fs.writeFile(versionPath, version, (err) => {
-                        if (err) {
-                            rejectFn(err);
-                        }
-                    });
-                    resolveFn(filePath);
-                });
-            });
-        });
-        return p;
+        await pipeline(req, fs.createWriteStream(zipPath));
+
+        if (zipPath.endsWith('.zip')) {
+            await unzipFile(zipPath, outputPath);
+        } else {
+            await untarFile(zipPath, outputPath);
+        }
+
+        await fs.promises.writeFile(versionPath, version);
     }
     return filePath;
 };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codefresh-sdk",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Codefresh_api_swagger_3_0_specification",
   "main": "index.js",
   "author": {
@@ -25,22 +25,21 @@
     "cf-errors": "^0.1.16",
     "compare-versions": "^3.4.0",
     "debug": "^4.1.1",
-    "decompress": "^4.2.1",
-    "decompress-targz": "^4.1.1",
-    "decompress-unzip": "^4.0.1",
     "firebase": "git+https://github.com/codefresh-io/firebase.git#80b2ed883ff281cd67b53bd0f6a0bbd6f330fed5",
     "fs-extra": "^7.0.1",
     "js-yaml": "^3.13.1",
     "jsonwebtoken": "^8.4.0",
     "lodash": "^4.17.21",
-    "moment": "^2.24.0",
+    "moment": "^2.29.4",
     "recursive-readdir": "^2.2.2",
     "request": "2.88.2",
     "request-promise": "4.2.6",
     "requestretry": "^7.0.2",
     "swagger-client": "~3.13.7",
+    "tar-stream": "^2.2.0",
     "uniqid": "^5.4.0",
-    "uuid": "^3.3.2"
+    "uuid": "^3.3.2",
+    "zip": "^1.2.0"
   },
   "devDependencies": {
     "eslint": "^7.32.0",