fix: parse tar verbose sizes strictly

steipete · steipete · commit 76130fd98873 · 2026-05-28T15:19:53.000-04:00
diff --git a/src/agents/skills-install-tar-verbose.test.ts b/src/agents/skills-install-tar-verbose.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { parseTarVerboseMetadata } from "./skills-install-tar-verbose.js";
+
+describe("parseTarVerboseMetadata", () => {
+  it("parses BSD and GNU tar verbose sizes", () => {
+    expect(parseTarVerboseMetadata("-rw-r--r--  0 user group 123 Jan 01 00:00 SKILL.md")).toEqual([
+      { type: "File", size: 123 },
+    ]);
+    expect(parseTarVerboseMetadata("-rw-r--r-- user/group 456 2026-05-28 00:00 SKILL.md")).toEqual([
+      { type: "File", size: 456 },
+    ]);
+  });
+
+  it("rejects partial or unsafe tar verbose size tokens", () => {
+    expect(() =>
+      parseTarVerboseMetadata("-rw-r--r--  0 user group 123abc Jan 01 00:00 SKILL.md"),
+    ).toThrow(/unable to parse tar entry size/u);
+    expect(() =>
+      parseTarVerboseMetadata("-rw-r--r-- user/group 9007199254740993 2026-05-28 00:00 SKILL.md"),
+    ).toThrow(/unable to parse tar entry size/u);
+  });
+});
diff --git a/src/agents/skills-install-tar-verbose.ts b/src/agents/skills-install-tar-verbose.ts
@@ -45,25 +45,28 @@ function parseTarVerboseSize(line: string): number {
 
   let dateIndex = tokens.findIndex((token) => TAR_VERBOSE_MONTHS.has(token));
   if (dateIndex > 0) {
-    const size = Number.parseInt(tokens[dateIndex - 1] ?? "", 10);
-    if (!Number.isFinite(size) || size < 0) {
-      throw new Error(`unable to parse tar entry size: ${line}`);
-    }
-    return size;
+    return parseTarSizeToken(tokens[dateIndex - 1] ?? "", line);
   }
 
   dateIndex = tokens.findIndex((token) => ISO_DATE_PATTERN.test(token));
   if (dateIndex > 0) {
-    const size = Number.parseInt(tokens[dateIndex - 1] ?? "", 10);
-    if (!Number.isFinite(size) || size < 0) {
-      throw new Error(`unable to parse tar entry size: ${line}`);
-    }
-    return size;
+    return parseTarSizeToken(tokens[dateIndex - 1] ?? "", line);
   }
 
   throw new Error(`unable to parse tar verbose metadata: ${line}`);
 }
 
+function parseTarSizeToken(raw: string, line: string): number {
+  if (!/^\d+$/.test(raw)) {
+    throw new Error(`unable to parse tar entry size: ${line}`);
+  }
+  const size = Number(raw);
+  if (!Number.isSafeInteger(size)) {
+    throw new Error(`unable to parse tar entry size: ${line}`);
+  }
+  return size;
+}
+
 export function parseTarVerboseMetadata(stdout: string): Array<{ type: string; size: number }> {
   const lines = normalizeStringEntries(stdout.split("\n"));
   return lines.map((line) => {
