10000 Allow tilde in zip entry names by jdleesmiller · Pull Request #391 · rubyzip/rubyzip · GitHub
[go: up one dir, main page]
Skip to content

Allow tilde in zip entry names #391

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 23, 2019
Merged

Allow tilde in zip entry names #391

merged 1 commit into from
May 23, 2019

Conversation

jdleesmiller
Copy link
Member

Use absolute_path rather than expand_path to allow tilde to pass through unchanged. Otherwise, we try to expand it to a home directory.

For example, a zip containing a file named ~tilde~ caused this error on extraction:

  1) Error:
PathTraversalTest#test_entry_name_with_tilde:
ArgumentError: user tilde~ doesn't exist
    /Users/john/ex/rubyzip/lib/zip/entry.rb:120:in `expand_path'

because it interpreted ~tilde~ as "get me the path to the home directory of the user tilde~.

An entry name containing ~ should still be considered 'safe', provided that the user doesn't use it in a shell context where the ~ would again be expanded.

This was introduced in #376 .

Thanks to @mmazour for catching this.

@coveralls
Copy link
coveralls commented Mar 3, 2019 •
edited
Loading

Coverage Status

Coverage increased (+4.08%) to 99.836% when pulling ad15c3c on jdleesmiller:fix-expand-path into 8ece5c9 on rubyzip:master.

@jdleesmiller
Allow tilde in zip entry names
ad15c3c 
Use absolute_path rather than expand_path to allow tilde to pass through
unchanged. Otherwise, we try to expand it to a home directory.
@jdleesmiller jdleesmiller mentioned this pull request Mar 22, 2019
Merged
@jdleesmiller jdleesmiller merged commit ef516bd into rubyzip:master May 23, 2019
@jdleesmiller jdleesmiller deleted the fix-expand-path branch May 23, 2019 17:33
This was referenced Mar 11, 2021
Open
Open
Open
Open
Open
Open
Open
Open
Closed
Merged
Merged
Closed
Open
Open
Open
Open
Open
Open
Open
Open
Merged
Open
This was referenced Mar 18, 2021
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jdleesmiller @coveralls
0