JS: Add test for zipslip basename sanitization.

jcreedcmu · jcreedcmu · commit 8829fde86bd8 · 2019-03-06T09:46:41.000Z
diff --git a/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlipGoodBasename.js b/javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlipGoodBasename.js
@@ -0,0 +1,10 @@
+const fs = require('fs');
+const unzip = require('unzip');
+const path = require('path');
+
+fs.createReadStream('archive.zip')
+  .pipe(unzip.Parse())
+  .on('entry', entry => {
+    const fileName = entry.path;
+    entry.pipe(fs.createWriteStream(path.join('my_directory', path.basename(fileName))));
+  });
