File tree 1 file changed +11
-5
lines changed
1 file changed +11
-5
lines changed Original file line number Diff line number Diff line change @@ -93,6 +93,11 @@ func (ta TarArchive) Decompress(destination string) error {
93
93
return fmt .Errorf ("failed to read tar response: %s" , err )
94
94
}
95
95
96
+ // Skip if the destination it the destination directory itself i.e. ./
97
+ if hdr .Name == "." + string (filepath .Separator ) {
98
+ continue
99
+ }
100
+
96
101
err = checkExtractPath (hdr .Name , destination )
97
102
if err != nil {
98
103
return err
@@ -328,6 +333,11 @@ func (z ZipArchive) Decompress(destination string) error {
328
333
}
329
334
330
335
for _ , f := range zr .File {
336
+ // Skip if the destination it the destination directory itself i.e. ./
337
+ if f .Name == "." + string (filepath .Separator ) {
338
+ continue
339
+ }
340
+
331
341
err = checkExtractPath (f .Name , destination )
332
342
if err != nil {
333
343
return err
@@ -409,12 +419,8 @@ func (z ZipArchive) Decompress(destination string) error {
409
419
}
410
420
411
421
// This function checks to see that the given path is within the destination
412
- // directory or it is the destination directory itself i.e. ./
422
+ // directory
413
423
func checkExtractPath (filePath string , destination string ) error {
414
- if filePath == "." + string (os .PathSeparator ) {
415
- return nil
416
- }
417
-
418
424
destpath := filepath .Join (destination , filePath )
419
425
if ! strings .HasPrefix (destpath , filepath .Clean (destination )+ string (os .PathSeparator )) {
420
426
return fmt .Errorf ("illegal file path %q: the file path does not occur within the destination directory" , filePath )
You can’t perform that action at this time.
0 commit comments