check that relative path does not contain ..

ipfs · Aug 5, 2021 · 1e861df · 1e861df
1 parent 654d975
commit 1e861df
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/extractor.go b/extractor.go
@@ -161,6 +161,11 @@ func (te *Extractor) Extract(reader io.Reader) error {
 		if err != nil || rel == "." {
 			return errInvalidRootMultipleRoots
 		}
+		for _, e := range strings.Split(rel, "/") {
+			if e == ".." {
+				return fmt.Errorf("relative path contains '..'")
+			}
+		}
 
 		switch header.Typeflag {
 		case tar.TypeDir: