Updated extraction to extract with key of original file path, extract…

…ing to a safe location (#1557)
ebkr · Nov 16, 2024 · 8563fea · 8563fea
1 parent 5e73a77
commit 8563fea
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/providers/generic/zip/AdmZipProvider.ts b/src/providers/generic/zip/AdmZipProvider.ts
@@ -24,9 +24,9 @@ export default class AdmZipProvider extends ZipProvider {
 
     async extractEntryTo(zip: string | Buffer, target: string, outputPath: string): Promise<void> {
         const adm = new AdmZip(zip);
-        target = target.replace(/\\/g, '/');
+        const safeTarget = target.replace(/\\/g, '/');
         outputPath = outputPath.replace(/\\/g, '/');
-        var fullPath = path.join(outputPath, target).replace(/\\/g, '/');
+        var fullPath = path.join(outputPath, safeTarget).replace(/\\/g, '/');
         if(!path.posix.normalize(fullPath).startsWith(outputPath))
         {
             throw Error("Entry " + target + " would extract outside of expected folder");