fix: npm pack marks the wrong files as executable

[kchindam-infy]

This PR fixes an issue where npm pack incorrectly marks files as executable if their paths contain the bin path as a substring. Specifically, the problem occurs when files located in directories like src/bin/ are erroneously marked as executable because their paths include the bin directory name.

Changes made:

• Updated lib/util/is-package-bin.js:

  • Changed the parameter name from path to filePath for clarity.
  • Removed the unreliable regular expression used to manipulate the path.
  • Introduced proper path handling by:
    • Removing the 'package/' prefix from filePath to get the relative path.
    • Normalizing both filePath and binPath using path.posix.normalize.
    • Comparing the normalized paths for an exact match.

• Ensured Cross-Platform Compatibility:

  • Used path.posix to handle paths consistently across different operating systems, particularly important for paths within tarballs.

  The issue was caused by improper path manipulation and comparison in is-package-bin.js. The original code did not correctly handle nested directories or different path formats, leading to unintended files being marked as executable.

By accurately processing and comparing paths, we ensure that only the exact files specified in the bin field of package.json are marked as executable. This aligns the behavior of npm pack with the expected outcome and prevents potential security risks or execution of unintended scripts.

References

[reggi]

why are filePaths that start with package "special", why does this need to be removed? this prefix seems arbitrary and permissible

[kchindam-infy]

The reason we need to remove the 'package/' prefix from filePath is that this prefix is added to all the file paths during the tarball creation process due to the prefix 'package/' option in tar-create-options.js. As a result filePath in the filter function includes this prefix e.g. 'package/bin/index.js'.

Since the paths specified in the bin field of package.json (e.g. 'bin/index.js') do not include this prefix, we need to adjust filePath to make an accurate comparison. By removing the 'package/' prefix (or better yet computing the relative path), we align filePath with how path are represented in package.json.

To avoid hardcoding the prefix, we can update the code to use path.relative. (const relativePath = path.relative('package', filePath); )

Let me know if this makes sense or if you'd like me to adjust code further