Skip to content
This repository has been archived by the owner on Nov 19, 2024. It is now read-only.

Commit

Permalink
Resolve a few go lint issues
Browse files Browse the repository at this point in the history
  • Loading branch information
Fergus Strange authored and petemoore committed Sep 28, 2020
1 parent a723054 commit c7eae9d
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 5 deletions.
3 changes: 1 addition & 2 deletions archiver_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -464,7 +464,7 @@ func TestSafeExtraction(t *testing.T) {

for _, archiveName := range testArchives {

expected := true // 'evilfile' should not be extracted outside of destination directory and 'safefile' should be extracted anyway in the destination folder anyway
expected := true // 'evilfile' should not be extracted outside of destination directory and 'safefile' should be extracted anyway in the destination folder anyway

if _, err := os.Stat(archiveName); os.IsNotExist(err) {
t.Errorf("archive not found")
Expand Down Expand Up @@ -535,4 +535,3 @@ func (ffi fakeFileInfo) Mode() os.FileMode { return ffi.mode }
func (ffi fakeFileInfo) ModTime() time.Time { return ffi.modTime }
func (ffi fakeFileInfo) IsDir() bool { return ffi.isDir }
func (ffi fakeFileInfo) Sys() interface{} { return ffi.sys }

6 changes: 3 additions & 3 deletions rar.go
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ func (*Rar) CheckExt(filename string) error {
// CheckPath ensures that the filename has not been crafted to perform path traversal attacks
func (*Rar) CheckPath(to, filename string) error {
to, _ = filepath.Abs(to) //explicit the destination folder to prevent that 'string.HasPrefix' check can be 'bypassed' when no destination folder is supplied in input
dest := filepath.Join(to, filename)
dest := filepath.Join(to, filename)
//prevent path traversal attacks
if !strings.HasPrefix(dest, to) {
return fmt.Errorf("illegal file path: %s", filename)
Expand Down Expand Up @@ -162,11 +162,11 @@ func (r *Rar) unrarNext(to string) error {
if !ok {
return fmt.Errorf("expected header to be *rardecode.FileHeader but was %T", f.Header)
}

errPath := r.CheckPath(to, header.Name)
if errPath != nil {
return fmt.Errorf("checking path traversal attempt: %v", errPath)
}
}

return r.unrarFile(f, filepath.Join(to, header.Name))
}
Expand Down

0 comments on commit c7eae9d

Please sign in to comment.