fix: Zip Path Traversal (#181)

Zip Path Traversal Bug: https://pms.uniontech.com/bug-view-232873.html Log: Zip Path Traversal
linuxdeepin · May 28, 2024 · e809e38 · e809e38
1 parent 85e5836
commit e809e38
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/3rdparty/libzipplugin/libzipplugin.cpp b/3rdparty/libzipplugin/libzipplugin.cpp
@@ -761,6 +761,11 @@ ErrorType LibzipPlugin::extractEntry(zip_t *archive, zip_int64_t index, const Ex
     }
 
     strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]);    // 解压文件名（压缩包中）
+    //fix 232873
+    if(strFileName.indexOf("../") != -1) {
+        qInfo() << "skipped ../ path component(s) in " << strFileName;
+        strFileName = strFileName.replace("../", "");
+    }
     if(strFileName.contains(QLatin1Char('\\')))
         strFileName = strFileName.replace(QLatin1Char('\\'), QDir::separator());
     QString strOriginName = strFileName;