Commits on May 2, 2018

1. fix: prevent extracting archived files outside of target path …

   This PR is meant to fix an arbitrary file write vulnerability, that can be
   achieved using a specially crafted zip archive, that holds path traversal
   filenames. When the filename gets concatenated to the target extraction
   directory, the final path ends up outside of the target folder.
   
   A sample malicious zip file named Zip.Evil.zip was used,
   and when running the code below, resulted in the creation of C:/Temp/evil.txt
   outside of the intended target directory.
   
   There are various possible ways to avoid this issue, some include checking
   for .. (dot dot) characters in the filename, but the best solution in our
   opinion is to check if the final target filename, starts with the target
   folder (after both are resolved to their absolute path).
   
   Stay secure,
   Snyk Team

   

   odinn1984 committed May 2, 2018
   Copy the full SHA

   80ceb1c View commit details

   Browse the repository at this point in the history