Restrict file extraction to the target path

bower / decompress-zip

Module that decompresses zip files

MIT License

102 stars 76 forks source link

Restrict file extraction to the target path #63

Closed Muelsy closed 5 years ago

Muelsy commented 5 years ago

Currently decompress-zip will extract files outside of the scope of the specified target directory. This has significant security implications when decompressing files from untrusted users.

This pull request aims to fix this issue by ensuring that the destination path is not be outside set path. \

A new unit test has also been added to verify this functionality. The test archive has been taken from https://github.com/snyk/zip-slip-vulnerability/tree/master/archives

sheerun commented 5 years ago

Thank you very much for contributing, I'm releasing it right away

sheerun commented 5 years ago

Released as 0.3.2