diff --git a/archiver_test.go b/archiver_test.go index 36b7cafe..89862c22 100644 --- a/archiver_test.go +++ b/archiver_test.go @@ -464,7 +464,7 @@ func TestSafeExtraction(t *testing.T) { for _, archiveName := range testArchives { - expected := true // 'evilfile' should not be extracted outside of destination directory and 'safefile' should be extracted anyway in the destination folder anyway + expected := true // 'evilfile' should not be extracted outside of destination directory and 'safefile' should be extracted anyway in the destination folder anyway if _, err := os.Stat(archiveName); os.IsNotExist(err) { t.Errorf("archive not found") @@ -535,4 +535,3 @@ func (ffi fakeFileInfo) Mode() os.FileMode { return ffi.mode } func (ffi fakeFileInfo) ModTime() time.Time { return ffi.modTime } func (ffi fakeFileInfo) IsDir() bool { return ffi.isDir } func (ffi fakeFileInfo) Sys() interface{} { return ffi.sys } - diff --git a/rar.go b/rar.go index 8c42372f..e259a971 100644 --- a/rar.go +++ b/rar.go @@ -63,7 +63,7 @@ func (*Rar) CheckExt(filename string) error { // CheckPath ensures that the filename has not been crafted to perform path traversal attacks func (*Rar) CheckPath(to, filename string) error { to, _ = filepath.Abs(to) //explicit the destination folder to prevent that 'string.HasPrefix' check can be 'bypassed' when no destination folder is supplied in input - dest := filepath.Join(to, filename) + dest := filepath.Join(to, filename) //prevent path traversal attacks if !strings.HasPrefix(dest, to) { return fmt.Errorf("illegal file path: %s", filename) @@ -162,11 +162,11 @@ func (r *Rar) unrarNext(to string) error { if !ok { return fmt.Errorf("expected header to be *rardecode.FileHeader but was %T", f.Header) } - + errPath := r.CheckPath(to, header.Name) if errPath != nil { return fmt.Errorf("checking path traversal attempt: %v", errPath) - } + } return r.unrarFile(f, filepath.Join(to, header.Name)) }