kylefang/adm-zip
1
0
Fork 0
mirror of https://github.com/zhigang1992/adm-zip.git synced 2026-04-29 20:35:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent extracting archived files outside of target path

Browse Source
This commit is contained in:
Aviad Reich
2018-04-22 11:22:24 +03:00
parent e116bc18df
commit 6f4dfeb9a2
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
adm-zip.js
View File

@@ -354,6 +354,9 @@ module.exports = function(/*String*/input) {
var target = pth.resolve(targetPath, maintainEntryPath ? entryName : pth.basename(entryName));
if(!target.startsWith(targetPath)) {
throw Utils.Errors.INVALID_FILENAME + ": " + entryName;
}
if (item.isDirectory) {
target = pth.resolve(target, "..");
@@ -429,6 +432,10 @@ module.exports = function(/*String*/input) {
_zip.entries.forEach(function(entry) {
entryName = entry.entryName.toString();
if(!pth.resolve(targetPath, entryName).startsWith(targetPath)) {
throw Utils.Errors.INVALID_FILENAME + ": " + entryName;
}
if(isWin){
entryName = escapeFileName(entryName)
}
@@ -471,6 +478,10 @@ module.exports = function(/*String*/input) {
entryName = escapeFileName(entryName)
}
if(!pth.resolve(targetPath, entryName).startsWith(targetPath)) {
throw Utils.Errors.INVALID_FILENAME + ": " + entryName;
}
if (entry.isDirectory) {
Utils.makeDir(pth.resolve(targetPath, entryName));
if(--i == 0)