fixed path traversal issue

.travis.yml

@@ -1,6 +1,5 @@
 sudo: false
 language: node_js
 node_js:
-  - '8'
-  - '6'
-  - '4'
+  - '12'
+  - '10'

index.js

@@ -24,7 +24,7 @@ module.exports = () => input => {
 				data: Buffer.concat(chunk),
 				mode: header.mode,
 				mtime: header.mtime,
-				path: header.name,
+				path: header.name.replace(/\.\.(\\|\/)/g, ""),
 				type: header.type
 			};
 

package.json

@@ -10,7 +10,7 @@
 		"url": "https://github.com/kevva"
 	},
 	"engines": {
-		"node": ">=4"
+		"node": ">=7.6"
 	},
 	"scripts": {
 		"test": "xo && ava"
@@ -31,8 +31,20 @@
 	},
 	"devDependencies": {
 		"ava": "*",
+		"esm": "^3.2.25",
 		"is-jpg": "^1.0.0",
 		"pify": "^3.0.0",
 		"xo": "*"
+	},
+	"xo": {
+		"rules": {
+			"promise/prefer-await-to-then": "off",
+			"quotes": "off"
+		}
+	},
+	"ava": {
+		"require": [
+			"esm"
+		]
 	}
 }

test.js

@@ -41,6 +41,16 @@ test('return empty array if non-valid file is supplied', async t => {
 	t.is(files.length, 0);
 });
 
+test('extract broken file', async t => {
+	const buf = await fsP.readFile(path.join(__dirname, 'fixtures', 'my-slip.tar'));
+	const files = await m()(buf);
+
+	t.is(files[0].path, 'tmp/slipped.txt');
+});
+
 test('throw on wrong input', async t => {
-	await t.throws(m()('foo'), 'Expected a Buffer or Stream, got string');
+	const error = await t.throwsAsync(async () => {
+		await m()('foo');
+	});
+	t.is(error.message, 'Expected a Buffer or Stream, got string');
 });