Replaces OS-specific unzip with cross-platform JS solution #4665
+127
−35
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR replaces platform-specific shell commands for zip extraction with a cross-platform JavaScript solution using the fflate library, improving reliability and security across different operating systems.
- Introduces a new
extractZipFilefunction with path traversal protection and selective extraction capabilities - Replaces PowerShell and unzip command usage with the fflate library for cross-platform compatibility
- Adds the fflate dependency and updates third-party notices accordingly
Reviewed Changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/env/node/gk/cli/utils.ts | Adds new extractZipFile function with security safeguards and cross-platform support |
| src/env/node/gk/cli/integration.ts | Replaces platform-specific shell commands with the new extractZipFile function |
| package.json | Adds fflate dependency for zip extraction functionality |
| ThirdPartyNotices.txt | Updates license information to include fflate library notice |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
- Filters files during extraction to only extract needed binaries - Adds path traversal protection for security - Automatically sets executable permissions on Unix systems
eamodio
force-pushed
the
debt/cli-unzip
branch
from
1bd33db to
bc99fca
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #4666
Overview
Replaces platform-specific shell commands for zip extraction with a JavaScript-based solution using the fflate library, improving reliability and security across different operating systems.
Key Improvements
Technical Changes
This change improves the reliability of CLI installation across different environments while enhancing security through built-in protections against zip-based attacks.