forked from pool/deepin-compressor
Hillwood Yang
14cb8a5658
- Add fix-Zip-Path-Traversal.patch * Fix Zip Path Traversal (boo#1218428 and CVE-2023-50255) OBS-URL: https://build.opensuse.org/request/show/1135475 OBS-URL: https://build.opensuse.org/package/show/X11:Deepin/deepin-compressor?expand=0&rev=17
16 lines
844 B
Diff
16 lines
844 B
Diff
diff -Nur deepin-compressor-5.12.13/3rdparty/libzipplugin/libzipplugin.cpp deepin-compressor-5.12.13-new/3rdparty/libzipplugin/libzipplugin.cpp
|
|
--- deepin-compressor-5.12.13/3rdparty/libzipplugin/libzipplugin.cpp 2022-12-28 13:50:00.000000000 +0800
|
|
+++ deepin-compressor-5.12.13-new/3rdparty/libzipplugin/libzipplugin.cpp 2023-12-28 20:41:04.137085065 +0800
|
|
@@ -741,6 +741,11 @@
|
|
}
|
|
|
|
strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]); // 解压文件名（压缩包中）
|
|
+ //fix 232873
|
|
+ if(strFileName.indexOf("../") != -1) {
|
|
+ qInfo() << "skipped ../ path component(s) in " << strFileName;
|
|
+ strFileName = strFileName.replace("../", "");
|
|
+ }
|
|
QString strOriginName = strFileName;
|
|
|
|
// 针对文件夹名称过长的情况，直接提示解压失败，文件夹名称过长
|