fix: remove unsafe regex

lib/get-paths.js

@@ -3,7 +3,7 @@
 // are present, then we can assume that they're associated.
 const binTarget = require('./bin-target.js')
 const manTarget = require('./man-target.js')
-const { resolve, basename } = require('path')
+const { resolve, basename, extname } = require('path')
 const isWindows = require('./is-windows.js')
 module.exports = ({ path, pkg, global, top }) => {
   if (top && !global) {
@@ -27,23 +27,14 @@ module.exports = ({ path, pkg, global, top }) => {
   const manSet = []
   if (manTarg && pkg.man && Array.isArray(pkg.man) && pkg.man.length) {
     for (const man of pkg.man) {
-      const parseMan = man.match(/(.*\.([0-9]+)(\.gz)?)$/)
-      // invalid entries invalidate the entire man set
-      if (!parseMan) {
+      if (!/.\.[0-9]+(\.gz)?$/.test(man)) {
         return binSet
       }
 
-      const stem = parseMan[1]
-      const sxn = parseMan[2]
-      const base = basename(stem)
-      const absFrom = resolve(path, man)
+      const section = extname(basename(man, '.gz')).slice(1)
+      const base = basename(man)
 
-      /* istanbul ignore if - should be impossible */
-      if (absFrom.indexOf(path) !== 0) {
-        return binSet
-      }
-
-      manSet.push(resolve(manTarg, 'man' + sxn, base))
+      manSet.push(resolve(manTarg, 'man' + section, base))
     }
   }