[filesystem] ZipManager: skip path traversal

[Rechi]

Description

Skip items in a zip file, which try to traverse to a parent directory.
Backport of #12023

Motivation and Context

Without this a zip file can override every file the current user has write permission.

How Has This Been Tested?

Tested with a malicious zip file.

Types of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the Code guidelines of this project
• My change requires a change to the documentation, either Doxygen or wiki
• I have updated the documentation accordingly
• I have read the CONTRIBUTING document
• I have added tests to cover my change
• All new and existing tests passed

[Rechi]

updated to be equal with #12023

[MartijnKaijser]

jenkins build this please

[MartijnKaijser]

jenkins build this please

[Rechi]

jenkins build this please

[pappalar]

Hello,

is this already available here?
https://kodi.tv/download

I see it is in the milestone and from https://kodi.tv/download seems that 17.2 has been released also there.

I just wanted to double check.
(also it is all on all platforms right?)

[pappalar]

Ok I found the article here: https://kodi.tv/article/kodi-v172-minor-bug-fix-and-security-release
Thanks :D

[razvansalajan]

Hi,

I will make a presentation about Hacked in translation at one of my computer science courses. I would like also to reproduce the bug with a zip file. Could any of you guys can help me out with a malicious zip file?

[stefansaraev]

@razvansalajan sorry for being harsh on you, but you should be able to make one yourself.