Check for valid package installation archive (#28)

os-js · Apr 10, 2020 · 568367d · 568367d
1 parent 4c6a40a
commit 568367d
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/src/packages.js b/src/packages.js
@@ -181,7 +181,16 @@ class Packages {
     await fs.mkdir(target);
     await extract(stream, target);
 
-    const filenames = await fg(root + '/*/metadata.json');
+    // FIXME: npm packages have a 'package' subdirectory
+    if (!await fs.exists(path.resolve(target, 'metadata.json'))) {
+      await fs.unlink(target);
+
+      throw new Error('Invalid package');
+    }
+
+    // TODO: Check conflicts ?
+
+    const filenames = await fg(root + '/*/metadata.json'); // FIXME: Windows!
     const metadatas = await Promise.all(filenames.map(f => fs.readJson(f)));
 
     await fs.writeJson(manifest, metadatas);