yarnpkg/yarn

Files are extracted before their hashes are checked.

Open

#4,638 opened on Oct 5, 2017

View on GitHub
 (13 comments) (0 reactions) (0 assignees)JavaScript (2,731 forks)batch import
cat-featuregood first issuehelp wantedtriaged

Repository metrics

Stars
 (41,514 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Do you want to request a feature or report a bug? A bug.

What is the current behavior? Currently, downloaded files are extracted before their hashes are checked. https://github.com/yarnpkg/yarn/blob/master/src/fetchers/tarball-fetcher.js#L75

What is the expected behavior? Files should be verified before they are extracted.

Contributor guide

Research direction
Modify the tarball fetcher to check file hashes before extraction. Locate the hash verification logic and move it before the extraction step.
Tech stack
javascript
Domain
cli
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaScriptGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70