mirror of
https://github.com/php/php-src.git
synced 2025-08-16 05:58:45 +02:00
Fix #81420: ZipArchive::extractTo extracts outside of destination
We need to properly detect and handle absolute paths in a portable way.
This commit is contained in:
parent
521bd7ce15
commit
df2ceac25a
3 changed files with 26 additions and 2 deletions
|
@ -106,8 +106,8 @@ static char * php_zip_make_relative_path(char *path, size_t path_len) /* {{{ */
|
|||
return NULL;
|
||||
}
|
||||
|
||||
if (IS_SLASH(path[0])) {
|
||||
return path + 1;
|
||||
if (IS_ABSOLUTE_PATH(path, path_len)) {
|
||||
return path + COPY_WHEN_ABSOLUTE(path) + 1;
|
||||
}
|
||||
|
||||
i = path_len;
|
||||
|
|
24
ext/zip/tests/bug81420.phpt
Normal file
24
ext/zip/tests/bug81420.phpt
Normal file
|
@ -0,0 +1,24 @@
|
|||
--TEST--
|
||||
Bug #81420 (ZipArchive::extractTo extracts outside of destination)
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!extension_loaded("zip")) die("skip zip extension not available");
|
||||
?>
|
||||
--FILE--
|
||||
<?php
|
||||
$zip = new ZipArchive();
|
||||
$zip->open(__DIR__ . "/bug81420.zip");
|
||||
$destination = __DIR__ . "/bug81420";
|
||||
mkdir($destination);
|
||||
$zip->extractTo($destination);
|
||||
var_dump(file_exists("$destination/nt1/zzr_noharm.php"));
|
||||
?>
|
||||
--CLEAN--
|
||||
<?php
|
||||
$destination = __DIR__ . "/bug81420";
|
||||
@unlink("$destination/nt1/zzr_noharm.php");
|
||||
@rmdir("$destination/nt1");
|
||||
@rmdir($destination);
|
||||
?>
|
||||
--EXPECT--
|
||||
bool(true)
|
BIN
ext/zip/tests/bug81420.zip
Normal file
BIN
ext/zip/tests/bug81420.zip
Normal file
Binary file not shown.
Loading…
Add table
Add a link
Reference in a new issue