github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Prevent arbitrary file write when decompressing files (#18421)

Browse Source 
* SECURITY: Prevent arbitrary file write when decompressing files
* FIX: Allow decompressing files into symlinked directories

Co-authored-by: OsamaSayegh <asooomaasoooma90@gmail.com>
Co-authored-by: Gerhard Schlager <gerhard.schlager@discourse.org>
This commit is contained in:
Jarek Radosz
2022-09-29 20:00:38 +02:00
committed by GitHub
parent ae1e536e83
commit b27d5626d2
9 changed files with 175 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
lib/compression/zip.rb
View File

@ -35,17 +35,12 @@ module Compression
yield(zip_file)
end
def build_entry_path(compressed_file, dest_path, compressed_file_path, entry, allow_non_root_folder)
folder_name = compressed_file_path.split('/').last.gsub('.zip', '')
root = root_folder_present?(compressed_file, allow_non_root_folder) ? '' : "#{folder_name}/"
File.join(dest_path, "#{root}#{entry.name}").tap do |entry_path|
FileUtils.mkdir_p(File.dirname(entry_path))
end
def build_entry_path(dest_path, entry, _)
File.join(dest_path, entry.name)
end
def root_folder_present?(filenames, allow_non_root_folder)
filenames.map { |p| p.name.split('/').first }.uniq.size == 1 || allow_non_root_folder
def decompression_results_path(dest_path, _)
dest_path
end
def extract_file(entry, entry_path, available_size)