.github/workflows/pr.yaml

@@ -0,0 +1,42 @@
+name: pull-request
+
+on:
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - uses: actions/setup-node@v2
+        with:
+          node-version: 'lts/*'
+          cache: 'npm'
+
+      - name: Cache Node modules
+        uses: actions/cache@v2
+        env:
+          cache-name: cache-node-modules
+        with:
+          # npm cache files are stored in `~/.npm` on Linux/macOS
+          path: ~/.npm
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+      - name: "Install dependencies"
+        run: |
+          npm install
+          sudo npx playwright install-deps
+
+      - name: Lint
+        run: npm run lint
+      - name: Test Node
+        run: npm run test-node
+      - name: Test browsers
+        run: |
+          npm run test-browser

.gitignore

@@ -1,4 +1,5 @@
 *~
+.c9revisions
+.DS_Store
 node_modules
-sauce_connect.log
-.c9revisions
+sauce_connect.log

CHANGES.md

@@ -4,6 +4,15 @@ layout: default
 section: main
 ---
 
+### v3.8.0 2022-03-30
+
+- Santize filenames when files are loaded with `loadAsync`, to avoid ["zip slip" attacks](https://snyk.io/research/zip-slip-vulnerability). The original filename is available on each zip entry as `unsafeOriginalName`. See the [documentation](https://stuk.github.io/jszip/documentation/api_jszip/load_async.html). Many thanks to McCaulay Hudson for reporting.
+
+### v3.7.1 2021-08-05
+
+- Fix build of `dist` files.
+    + Note: this version ensures the changes from 3.7.0 are actually included in the `dist` files. Thanks to Evan W for reporting.
+
 ### v3.7.0 2021-07-23
 
 - Fix: Use a null prototype object for this.files  (see [#766](https://github.com/Stuk/jszip/pull/766))

Gruntfile.js

@@ -2,53 +2,9 @@
 "use strict";
 
 module.exports = function(grunt) {
-  // https://wiki.saucelabs.com/display/DOCS/Platform+Configurator
-  // A lot of the browsers seem to time out with Saucelab's unit testing
-  // framework. Here are the browsers that work and get enough coverage for our
-  // needs.
-  var browsers = [
-    {browserName: "chrome"},
-    {browserName: "firefox", platform: "Linux"},
-    {browserName: "internet explorer"}
-  ];
-
-  var tags = [];
-  if (process.env.TRAVIS_PULL_REQUEST && process.env.TRAVIS_PULL_REQUEST != "false") {
-    tags.push("pr" + process.env.TRAVIS_PULL_REQUEST);
-  } else if (process.env.TRAVIS_BRANCH) {
-    tags.push(process.env.TRAVIS_BRANCH);
-  }
-
   var version = require("./package.json").version;
 
   grunt.initConfig({
-    connect: {
-      server: {
-        options: {
-          base: "",
-          port: 8080
-        }
-      }
-    },
-    'saucelabs-qunit': {
-      all: {
-        options: {
-          urls: ["http://127.0.0.1:8080/test/index.html?hidepassed"],
-          build: process.env.TRAVIS_JOB_ID,
-          throttled: 4,
-          "max-duration": 1200, // seconds, IE6 is slow
-          browsers: browsers,
-          testname: "qunit tests",
-          tags: tags,
-          // Tests have statusCheckAttempts * pollInterval seconds to complete
-          pollInterval: 2000,
-          statusCheckAttempts: 240,
-          "max-duration": 1200,
-          browsers: browsers,
-          maxRetries: 2
-        }
-      }
-    },
     jshint: {
       // see https://github.com/gruntjs/grunt-contrib-jshint/issues/198
       // we can't override the options using the jshintrc path
@@ -102,25 +58,10 @@ module.exports = function(grunt) {
     }
   });
 
-  grunt.loadNpmTasks("grunt-contrib-connect");
-  grunt.loadNpmTasks("grunt-saucelabs");
   grunt.loadNpmTasks('grunt-browserify');
   grunt.loadNpmTasks('grunt-contrib-jshint');
   grunt.loadNpmTasks('grunt-contrib-uglify');
 
-  // A task to cause Grunt to sit and wait, keeping the test server running
-  grunt.registerTask("wait", function() {
-    this.async();
-  });
-
-  grunt.registerTask("test-local", ["build", "connect", "wait"]);
-  grunt.registerTask("test-remote", ["build", "connect", "saucelabs-qunit"]);
-
-  if (process.env.SAUCE_USERNAME && process.env.SAUCE_ACCESS_KEY) {
-    grunt.registerTask("test", ["jshint", "test-remote"]);
-  } else {
-    grunt.registerTask("test", ["jshint", "test-local"]);
-  }
   grunt.registerTask("build", ["browserify", "uglify"]);
   grunt.registerTask("default", ["jshint", "build"]);
 };

LICENSE.markdown

@@ -1,4 +1,4 @@
-JSZip is dual licensed. You may use it under the MIT license *or* the GPLv3
+JSZip is dual licensed. At your choice you may use it under the MIT license *or* the GPLv3
 license.
 
 The MIT License