Fix custom deploy zip file size limitation

__tests__/bin/vip-app-deploy-validate.e2e.js

@@ -0,0 +1,65 @@
+import * as exit from '../../src/lib/cli/exit';
+import { validateZipFile } from '../../src/lib/validations/custom-deploy';
+
+const exitSpy = jest.spyOn( exit, 'withError' );
+jest.spyOn( process, 'exit' ).mockImplementation( () => {} );
+console.error = jest.fn();
+
+describe( 'vip-app-deploy-validate e2e', () => {
+	beforeEach( async () => {
+		jest.clearAllMocks();
+	} );
+
+	describe( 'validateZipFile', () => {
+		it.each( [
+			//	Archive:  __fixtures__/custom-deploy/valid-zip-posix.zip
+			//		__MACOSX/
+			//		mysite/
+			//		mysite/.DS_Store
+			//		mysite/__MACOSX
+			//		mysite/themes
+			//		mysite/themes/.DS_Store
+			//		mysite/themes/__MACOSX
+			//		mysite/themes/mytheme.php
+			'__fixtures__/custom-deploy/valid-zip-posix.zip',
+
+			//	Archive:  __fixtures__/custom-deploy/valid-zip-win32.zip
+			//		mysite/
+			//		mysite/themes
+			//		mysite/themes/mytheme.php
+			'__fixtures__/custom-deploy/valid-zip-win32.zip',
+		] )( 'should not throw error for valid zip file: %s', async file => {
+			await validateZipFile( file );
+
+			expect( exitSpy ).not.toHaveBeenCalled();
+		} );
+
+		it.each( [
+			{
+				//	Archive:  __fixtures__/custom-deploy/invalid-file-chars.zip
+				//		mysite/
+				//		mysite/themes
+				//		mysite/themes/invalid-file-name?.txt
+				file: '__fixtures__/custom-deploy/invalid-file-chars.zip',
+				error: `Filename invalid-file-name?.txt contains disallowed characters: [!/:*?"<>|'/^..]+`,
+			},
+			{
+				//	Archive:  __fixtures__/custom-deploy/no-root-folder.zip
+				//		no-root-folder.txt
+				file: '__fixtures__/custom-deploy/no-root-folder.zip',
+				error: `The compressed file must contain a single root directory.`,
+			},
+			{
+				//	Archive:  __fixtures__/custom-deploy/no-themes-folder.zip
+				//		mysite/
+				//		mysite/file
+				file: '__fixtures__/custom-deploy/no-themes-folder.zip',
+				error: `Missing \`themes\` directory from root folder.`,
+			},
+		] )( 'should throw an error for invalid zip file - $file', async ( { file, error } ) => {
+			await validateZipFile( file );
+
+			expect( exitSpy ).toHaveBeenCalledWith( error );
+		} );
+	} );
+} );

package.json

@@ -114,7 +114,6 @@
     "@babel/preset-typescript": "7.26.0",
     "@jest/globals": "^29.7.0",
     "@jest/test-sequencer": "^29.7.0",
-    "@types/adm-zip": "^0.5.5",
     "@types/args": "^5.0.3",
     "@types/cli-table": "^0.3.4",
     "@types/configstore": "5.0.1",
@@ -145,7 +144,6 @@
     "@automattic/vip-go-preflight-checks": "^2.0.16",
     "@automattic/vip-search-replace": "^1.1.1",
     "@json2csv/plainjs": "^7.0.3",
-    "adm-zip": "^0.5.14",
     "args": "5.0.3",
     "chalk": "4.1.2",
     "check-disk-space": "3.4.0",
@@ -165,6 +163,7 @@
     "jwt-decode": "4.0.0",
     "lando": "github:automattic/lando-cli.git#6ca2668",
     "node-fetch": "^2.6.1",
+    "node-stream-zip": "1.15.0",
     "open": "^10.0.0",
     "proxy-from-env": "^1.1.0",
     "semver": "7.6.3",

src/bin/vip-app-deploy-validate.ts

@@ -41,7 +41,7 @@ export async function appDeployValidateCmd(
 
 	const ext = extname( fileName );
 	if ( ext === '.zip' ) {
-		validateZipFile( fileName );
+		await validateZipFile( fileName );
 	} else {
 		await validateTarFile( fileName );
 	}

src/lib/validations/custom-deploy.ts

@@ -1,4 +1,4 @@
-import AdmZip from 'adm-zip';
+import StreamZip, { ZipEntry } from 'node-stream-zip';
 import { constants } from 'node:fs';
 import path from 'path';
 import * as tar from 'tar';
@@ -77,14 +77,14 @@ export function validateName( name: string, isDirectory: boolean ) {
 /**
  * Validate the existence of a symlink in a zip file. Ignores symlinks in node_modules/.bin/
  *
- * @param {IZipEntry} entry The zip entry to validate
+ * @param {ZipEntry} entry The zip entry to validate
  */
-function validateZipSymlink( entry: AdmZip.IZipEntry ) {
-	if ( symlinkIgnorePattern.test( entry.entryName ) ) {
+function validateZipSymlink( entry: ZipEntry ) {
+	if ( symlinkIgnorePattern.test( entry.name ) ) {
 		return;
 	}
 
-	const madeBy = entry.header.made >> 8; // eslint-disable-line no-bitwise
+	const madeBy = entry.verMade >> 8; // eslint-disable-line no-bitwise
 	const errorMsg = errorMessages.symlink + entry.name;
 
 	// DOS
@@ -104,26 +104,31 @@ function validateZipSymlink( entry: AdmZip.IZipEntry ) {
  * Validate a zip entry for disallowed characters and symlinks.
  * Ignores __MACOSX directories.
  *
- * @param {IZipEntry} entry The zip entry to validate
+ * @param {ZipEntry} entry The zip entry to validate
  */
-function validateZipEntry( entry: AdmZip.IZipEntry ) {
-	if ( entry.entryName.startsWith( macosxDir ) ) {
+function validateZipEntry( entry: ZipEntry ) {
+	if ( entry.name.startsWith( macosxDir ) ) {
 		return;
 	}
 
-	validateName( entry.isDirectory ? entry.entryName : entry.name, entry.isDirectory );
+	validateName( entry.isDirectory ? entry.name : path.basename( entry.name ), entry.isDirectory );
 	validateZipSymlink( entry );
 }
 
 /**
  * Validate the existence of a themes directory in the root folder.
  *
- * @param {IZipEntry[]} zipEntries The zip entries to validate
+ * @param rootFolder The root folder of the zip file
+ * @param {ZipEntry[]} zipEntries The zip entries to validate
  */
-function validateZipThemes( rootFolder: string, zipEntries: AdmZip.IZipEntry[] ) {
-	const hasThemesDir = zipEntries.some(
-		entry => entry.isDirectory && entry.entryName.startsWith( path.join( rootFolder, 'themes/' ) )
-	);
+function validateZipThemes( rootFolder: string, zipEntries: ZipEntry[] ) {
+	const hasThemesDir = zipEntries.some( entry => {
+		// Convert win32 path separators to posix path separators
+		const posixPath = entry.name.replace( /\\/g, '/' );
+		const requiredPosixPath = path.join( rootFolder, 'themes/' ).replace( /\\/g, '/' );
+
+		return entry.isDirectory && posixPath.startsWith( requiredPosixPath );
+	} );
 
 	if ( ! hasThemesDir ) {
 		exit.withError( errorMessages.missingThemes );
@@ -135,25 +140,26 @@ function validateZipThemes( rootFolder: string, zipEntries: AdmZip.IZipEntry[] )
  *
  * @param {string} filePath The path to the zip file
  */
-export function validateZipFile( filePath: string ) {
+export async function validateZipFile( filePath: string ) {
 	try {
-		const zipFile = new AdmZip( filePath );
-		const zipEntries = zipFile.getEntries();
+		const zipFile = new StreamZip.async( { file: filePath } );
+
+		const zipEntries = await zipFile.entries();
 
-		const rootDirs = zipEntries.filter(
+		const rootDirs = Object.values( zipEntries ).filter(
 			entry =>
 				entry.isDirectory &&
-				! entry.entryName.startsWith( macosxDir ) &&
-				( entry.entryName.match( /\//g ) || [] ).length === 1
+				! entry.name.startsWith( macosxDir ) &&
+				( entry.name.match( /\//g ) || [] ).length === 1
 		);
 		if ( rootDirs.length !== 1 ) {
 			exit.withError( errorMessages.singleRootDir );
 		}
 
-		const rootFolder = rootDirs[ 0 ].entryName;
-		validateZipThemes( rootFolder, zipEntries );
+		const rootFolder = rootDirs[ 0 ].name;
+		validateZipThemes( rootFolder, Object.values( zipEntries ) );
 
-		zipEntries.forEach( entry => validateZipEntry( entry ) );
+		Object.values( zipEntries ).forEach( entry => validateZipEntry( entry ) );
 	} catch ( error ) {
 		const err = error as Error;
 		exit.withError( `Error reading file: ${ err.message }` );