From eba8586d2b387356d28b6b61046571818a8d0ecb Mon Sep 17 00:00:00 2001
From: Jason Sommer <jsdirv@gmail.com>
Date: Mon, 16 Feb 2015 20:38:52 -0600
Subject: [PATCH] Fixed relative filepath check

Signed-off-by: Jason Sommer <jsdirv@gmail.com>
---
 archive/archive.go            |  2 +-
 archive/diff.go               |  2 +-
 chrootarchive/archive_test.go | 26 ++++++++++++++++++++++++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/archive/archive.go b/archive/archive.go
index d9fcead..d786e6e 100644
--- a/archive/archive.go
+++ b/archive/archive.go
@@ -525,7 +525,7 @@ loop:
 		if err != nil {
 			return err
 		}
-		if strings.HasPrefix(rel, "..") {
+		if strings.HasPrefix(rel, "../") {
 			return breakoutError(fmt.Errorf("%q is outside of %q", hdr.Name, dest))
 		}
 
diff --git a/archive/diff.go b/archive/diff.go
index ca28207..b5eb63f 100644
--- a/archive/diff.go
+++ b/archive/diff.go
@@ -81,7 +81,7 @@ func UnpackLayer(dest string, layer ArchiveReader) (size int64, err error) {
 		if err != nil {
 			return 0, err
 		}
-		if strings.HasPrefix(rel, "..") {
+		if strings.HasPrefix(rel, "../") {
 			return 0, breakoutError(fmt.Errorf("%q is outside of %q", hdr.Name, dest))
 		}
 		base := filepath.Base(path)
diff --git a/chrootarchive/archive_test.go b/chrootarchive/archive_test.go
index b3f7d57..fb4c5c4 100644
--- a/chrootarchive/archive_test.go
+++ b/chrootarchive/archive_test.go
@@ -99,3 +99,29 @@ func TestChrootApplyEmptyArchiveFromSlowReader(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestChrootApplyDotDotFile(t *testing.T) {
+	tmpdir, err := ioutil.TempDir("", "docker-TestChrootApplyDotDotFile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpdir)
+	src := filepath.Join(tmpdir, "src")
+	if err := os.MkdirAll(src, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := ioutil.WriteFile(filepath.Join(src, "..gitme"), []byte(""), 0644); err != nil {
+		t.Fatal(err)
+	}
+	stream, err := archive.Tar(src, archive.Uncompressed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dest := filepath.Join(tmpdir, "dest")
+	if err := os.MkdirAll(dest, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ApplyLayer(dest, stream); err != nil {
+		t.Fatal(err)
+	}
+}