fix extracting files with tricky pathnames containing . and .. (fix #712

)
elfmz · Jun 21, 2020 · 243730c · 243730c
1 parent 88e6a11
commit 243730c
Show file tree

Hide file tree

Showing 4 changed files with 29 additions and 7 deletions.
diff --git a/multiarc/src/formats/libarch/libarch_cmd_read.cpp b/multiarc/src/formats/libarch/libarch_cmd_read.cpp
@@ -47,10 +47,9 @@ static bool LIBARCH_CommandReadWanteds(const char *cmd, LibArchOpenRead &arc, co
 		}
 
 		const char *pathname = archive_entry_pathname(entry);
-
 		src_path = pathname ? pathname : "";
 		parts.clear();
-		StrExplode(parts, src_path, "/\\");
+		LibArch_ParsePathToParts(parts, src_path);
 
 		if (parts.empty()) {
 			fprintf(stderr, "Empty path: '%s'\n", pathname);
@@ -108,10 +107,10 @@ bool LIBARCH_CommandRead(const char *cmd, const char *arc_path, const char *arc_
 	for (int i = 0; i < files_cnt; ++i) {
 		wanteds.emplace_back();
 		if (arc_root_path && *arc_root_path) {
-			StrExplode(wanteds.back(), std::string(arc_root_path), "/\\");
+			LibArch_ParsePathToParts(wanteds.back(), std::string(arc_root_path));
 		}
 		if (files[i] && *files[i]) {
-			StrExplode(wanteds.back(), std::string(files[i]), "/\\");
+			LibArch_ParsePathToParts(wanteds.back(), std::string(files[i]));
 		}
 		if (wanteds.back().empty()) {
 			fprintf(stderr, "Skipping empty path: '%s'\n", files[i]);

diff --git a/multiarc/src/formats/libarch/libarch_cmd_write.cpp b/multiarc/src/formats/libarch/libarch_cmd_write.cpp
@@ -213,10 +213,10 @@ static bool LIBARCH_CommandRemoveOrReplace(const char *cmd, const char *arc_path
 		files_parts.emplace_back();
 		if (arc_root_path && *arc_root_path) {
 			str = arc_root_path;
-			StrExplode(files_parts.back(), str, "/\\");
+			LibArch_ParsePathToParts(files_parts.back(), str);
 		}
 		str = files[i];
-		StrExplode(files_parts.back(), str, "/\\");
+		LibArch_ParsePathToParts(files_parts.back(), str);
 	}
 
 	std::vector<std::string> parts;
@@ -233,7 +233,7 @@ static bool LIBARCH_CommandRemoveOrReplace(const char *cmd, const char *arc_path
 			if (pathname) {
 				parts.clear();
 				str = pathname;
-				StrExplode(parts, str, "/\\");
+				LibArch_ParsePathToParts(parts, str);
 				bool matches = false;
 				for (const auto &fp : files_parts) {
 					size_t i = 0;

diff --git a/multiarc/src/formats/libarch/libarch_utils.cpp b/multiarc/src/formats/libarch/libarch_utils.cpp
@@ -27,6 +27,27 @@ bool LibArch_DetectedFormatHasCompression(struct archive *a)
 }
 
 
+void LibArch_ParsePathToParts(std::vector<std::string> &parts, const std::string &path)
+{
+	size_t i = parts.size();
+	StrExplode(parts, path, "/");
+	while (i < parts.size()) {
+		if (parts[i] == ".") {
+			parts.erase(parts.begin() + i);
+		} else if (parts[i] == "..") {
+			parts.erase(parts.begin() + i);
+			if (i != 0) {
+				parts.erase(parts.begin() + i - 1);
+				--i;
+			} else {
+				fprintf(stderr, "LibArch_ParsePathToParts: impossible <..> in '%s'\n", path.c_str());
+			}
+		} else {
+			++i;
+		}
+	}
+}
+
 LibArchOpenRead::LibArchOpenRead(const char *name, const char *cmd)
 {
 	Open(name);

diff --git a/multiarc/src/formats/libarch/libarch_utils.h b/multiarc/src/formats/libarch/libarch_utils.h
@@ -18,6 +18,7 @@ template <typename ... ARGS>
 };
 
 bool LibArch_DetectedFormatHasCompression(struct archive *a);
+void LibArch_ParsePathToParts(std::vector<std::string> &parts, const std::string &path);
 
 struct LibArchOpenRead
 {
@@ -67,3 +68,4 @@ struct LibArchOpenWrite
 private:
 	LibArchOpenWrite(const LibArchOpenWrite&) = delete;
 };
+