Closed BlueSquare1 closed 8 months ago
We just got this warning in snyk. Has anyone found a workaround?
Awesome work @weichsel to fix this and other vulnerabilities! When do you plan to publish a new release?
@weichsel when will be next release with this fix?
Summary
The package does not check if symlinks are pointing to paths outside the extraction directory
Steps to Reproduce
1- Generate
payload.zip
using the following code:2- Extract
payload.zip
usingunzipItem
Expected Results
evil_symlink
is not linked back after extractionActual Results
evil_symlink
is linked back after extractionTechnical details
Upon extraction, the package passes the path coming from the zip entry directly to
fileManager.createSymbolicLink
without checking that it is located within extraction directory