0.7.2

guzba · Oct 5, 2021 · a35f414 · a35f414
1 parent 228a6e1
commit a35f414
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/src/zippy/tarballs.nim b/src/zippy/tarballs.nim
@@ -311,6 +311,11 @@ proc extractAll*(
           ZippyError,
           "Extracting paths starting with `..` is not supported (" & path & ")"
         )
+      if "/../" in path or r"\..\" in path:
+        raise newException(
+          ZippyError,
+          "Extracting paths containing `/../` is not supported (" & path & ")"
+        )
 
       case entry.kind:
       of ekNormalFile:

diff --git a/src/zippy/ziparchives.nim b/src/zippy/ziparchives.nim
@@ -479,6 +479,11 @@ proc extractAll*(
           ZippyError,
           "Extracting paths starting with `..` is not supported (" & path & ")"
         )
+      if "/../" in path or r"\..\" in path:
+        raise newException(
+          ZippyError,
+          "Extracting paths containing `/../` is not supported (" & path & ")"
+        )
 
       case entry.kind:
       of ekDirectory:

diff --git a/zippy.nimble b/zippy.nimble
@@ -1,4 +1,4 @@
-version       = "0.7.1"
+version       = "0.7.2"
 author        = "Ryan Oldenburg"
 description   = "Pure Nim implementation of deflate, zlib, gzip and zip."
 license       = "MIT"