We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent c528cc7 commit 20a6137Copy full SHA for 20a6137
extractor.go
@@ -104,7 +104,12 @@ func (te *Extractor) Sanitize(toggle bool) {
104
105
// outputPath returns the path at which to place tarPath
106
func (te *Extractor) outputPath(tarPath string) (outPath string, err error) {
107
- elems := strings.Split(tarPath, "/") // break into elems
+ elems := strings.Split(tarPath, "/") // break into elems
108
+ for _, e := range elems {
109
+ if e == ".." {
110
+ return "", fmt.Errorf("%s : path contains '..'", tarPath)
111
+ }
112
113
elems = elems[1:] // remove original root
114
outPath = strings.Join(elems, "/") // join elems
115
outPath = gopath.Join(te.Path, outPath) // rebase on to extraction target root
0 commit comments