mirror of
https://github.com/php/php-src.git
synced 2025-08-16 05:58:45 +02:00
Fix #81420: ZipArchive::extractTo extracts outside of destination
We need to properly detect and handle absolute paths in a portable way.
This commit is contained in:
parent
521bd7ce15
commit
df2ceac25a
3 changed files with 26 additions and 2 deletions
|
@ -106,8 +106,8 @@ static char * php_zip_make_relative_path(char *path, size_t path_len) /* {{{ */
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (IS_SLASH(path[0])) {
|
if (IS_ABSOLUTE_PATH(path, path_len)) {
|
||||||
return path + 1;
|
return path + COPY_WHEN_ABSOLUTE(path) + 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
i = path_len;
|
i = path_len;
|
||||||
|
|
24
ext/zip/tests/bug81420.phpt
Normal file
24
ext/zip/tests/bug81420.phpt
Normal file
|
@ -0,0 +1,24 @@
|
||||||
|
--TEST--
|
||||||
|
Bug #81420 (ZipArchive::extractTo extracts outside of destination)
|
||||||
|
--SKIPIF--
|
||||||
|
<?php
|
||||||
|
if (!extension_loaded("zip")) die("skip zip extension not available");
|
||||||
|
?>
|
||||||
|
--FILE--
|
||||||
|
<?php
|
||||||
|
$zip = new ZipArchive();
|
||||||
|
$zip->open(__DIR__ . "/bug81420.zip");
|
||||||
|
$destination = __DIR__ . "/bug81420";
|
||||||
|
mkdir($destination);
|
||||||
|
$zip->extractTo($destination);
|
||||||
|
var_dump(file_exists("$destination/nt1/zzr_noharm.php"));
|
||||||
|
?>
|
||||||
|
--CLEAN--
|
||||||
|
<?php
|
||||||
|
$destination = __DIR__ . "/bug81420";
|
||||||
|
@unlink("$destination/nt1/zzr_noharm.php");
|
||||||
|
@rmdir("$destination/nt1");
|
||||||
|
@rmdir($destination);
|
||||||
|
?>
|
||||||
|
--EXPECT--
|
||||||
|
bool(true)
|
BIN
ext/zip/tests/bug81420.zip
Normal file
BIN
ext/zip/tests/bug81420.zip
Normal file
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue