Sanitize zip entry paths before extracting #121
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Zip entries can contain relative paths that end up outside the extraction directory if used as-is, for instance
..\..\..\..\file.txt, which can be a potential security risk. This sanitizes all paths before extraction while ensuring that valid relative paths are not lost.a\..\c\file.txt->c\file.txta\..\..\c\file.txt->c\file.txt..\..\..\..\c\file.txt->c\file.txta\b\..\c\file.txt->a\c\file.txta\b\c\..\e\..\..\f\file.txt->a\f\file.txtMany thanks to Snyk Security Research Team for tracking down this issue.