vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Fixed relative filepath check

Browse source 
Signed-off-by: Jason Sommer <jsdirv@gmail.com>
This commit is contained in:
Jason Sommer 2015-02-16 20:38:52 -06:00
parent 35464d7db3
commit eba8586d2b
3 changed files with 28 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
archive/archive.go
View file

@ -525,7 +525,7 @@ loop:
if err != nil {
return err
}
if strings.HasPrefix(rel, "..") {
if strings.HasPrefix(rel, "../") {
return breakoutError(fmt.Errorf("%q is outside of %q", hdr.Name, dest))
}

2
archive/diff.go
View file

@ -81,7 +81,7 @@ func UnpackLayer(dest string, layer ArchiveReader) (size int64, err error) {
if err != nil {
return 0, err
}
if strings.HasPrefix(rel, "..") {
if strings.HasPrefix(rel, "../") {
return 0, breakoutError(fmt.Errorf("%q is outside of %q", hdr.Name, dest))
}
base := filepath.Base(path)