Harden 85acab9

sindresorhus · sindresorhus · commit be33cbc35c25 · 2026-01-25T14:42:21.000+07:00
diff --git a/index.js b/index.js
@@ -9,8 +9,33 @@ import {isStream} from 'is-stream';
 
 const pipeline = promisify(stream.pipeline); // TODO: Use `node:stream/promises` when targeting Node.js 16.
 
-// Use `path.basename()` to prevent path traversal.
-const getPath = (prefix = '') => path.join(tempDir, path.basename(prefix) + uniqueString());
+// TODO: Use `is-safe-filename` when targeting Node.js 20.
+function assertSafePathComponent(pathComponent) {
+	if (typeof pathComponent !== 'string') {
+		throw new TypeError(`Expected a string, got ${typeof pathComponent}`);
+	}
+
+	const trimmed = pathComponent.trim();
+
+	const isSafe = trimmed !== ''
+		&& trimmed !== '.'
+		&& trimmed !== '..'
+		&& !pathComponent.includes('/')
+		&& !pathComponent.includes('\\')
+		&& !pathComponent.includes('\0');
+
+	if (!isSafe) {
+		throw new Error(`Unsafe path component: ${JSON.stringify(pathComponent)}`);
+	}
+}
+
+const getPath = (prefix = '') => {
+	if (prefix) {
+		assertSafePathComponent(prefix);
+	}
+
+	return path.join(tempDir, prefix + uniqueString());
+};
 
 const writeStream = async (filePath, data) => pipeline(data, fs.createWriteStream(filePath));
 
@@ -23,17 +48,21 @@ async function runTask(temporaryPath, callback) {
 }
 
 export function temporaryFile({name, extension} = {}) {
-	if (name) {
+	if (name !== undefined && name !== null) {
 		if (extension !== undefined && extension !== null) {
 			throw new Error('The `name` and `extension` options are mutually exclusive');
 		}
 
-		// Use `path.basename()` to prevent path traversal.
-		return path.join(temporaryDirectory(), path.basename(name));
+		assertSafePathComponent(name);
+
+		return path.join(temporaryDirectory(), name);
+	}
+
+	if (extension !== undefined && extension !== null) {
+		assertSafePathComponent(extension);
 	}
 
-	// Use `path.basename()` to prevent path traversal.
-	return getPath() + (extension === undefined || extension === null ? '' : '.' + path.basename(extension).replace(/^\./, ''));
+	return getPath() + (extension === undefined || extension === null ? '' : '.' + extension.replace(/^\./, ''));
 }
 
 export const temporaryFileTask = async (callback, options) => runTask(temporaryFile(options), callback);
diff --git a/test.js b/test.js
@@ -141,8 +141,32 @@ test('.root', t => {
 	t.true(path.isAbsolute(rootTemporaryDirectory));
 });
 
-test('path traversal prevention', t => {
-	t.true(temporaryFile({name: '../../../test'}).includes(tempDir));
-	t.true(temporaryFile({extension: '../../../test'}).includes(tempDir));
-	t.true(temporaryDirectory({prefix: '../../../test'}).includes(tempDir));
+// TODO: Use `unsafeFilenameFixtures` from `is-safe-filename` when targeting Node.js 20.
+const unsafeFilenameFixtures = [
+	'',
+	'   ',
+	'.',
+	'..',
+	' .',
+	'. ',
+	' ..',
+	'.. ',
+	'../',
+	'../foo',
+	'foo/../bar',
+	'foo/bar',
+	'foo\\bar',
+	'foo\0bar',
+];
+
+test('rejects unsafe path components', t => {
+	for (const fixture of unsafeFilenameFixtures) {
+		t.throws(() => temporaryFile({name: fixture}), {message: /Unsafe path component/});
+		t.throws(() => temporaryFile({extension: fixture}), {message: /Unsafe path component/});
+
+		// Empty string is valid for prefix (it's the default)
+		if (fixture !== '') {
+			t.throws(() => temporaryDirectory({prefix: fixture}), {message: /Unsafe path component/});
+		}
+	}
 });
