From da9d6e8dd2475ba74b72e816731a3c9aa31816a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?nils=20m=C3=A5s=C3=A9n?= Date: Sat, 8 May 2021 14:35:11 +0200 Subject: [PATCH 1/4] test: alter LimitExtractPath to check for file/dir collision --- test/ICSharpCode.SharpZipLib.Tests/Zip/FastZipHandling.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/ICSharpCode.SharpZipLib.Tests/Zip/FastZipHandling.cs b/test/ICSharpCode.SharpZipLib.Tests/Zip/FastZipHandling.cs index 9a6baac79..396f014bb 100644 --- a/test/ICSharpCode.SharpZipLib.Tests/Zip/FastZipHandling.cs +++ b/test/ICSharpCode.SharpZipLib.Tests/Zip/FastZipHandling.cs @@ -474,7 +474,7 @@ public void LimitExtractPath() tempPath = Path.Combine(tempPath, uniqueName); var extractPath = Path.Combine(tempPath, "output"); - const string contentFile = "content.txt"; + const string contentFile = "output.txt"; var contentFilePathBad = Path.Combine("..", contentFile); var extractFilePathBad = Path.Combine(tempPath, contentFile); From b852a74cd9cafbc0d34e008a4db23dc53d79bde5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?nils=20m=C3=A5s=C3=A9n?= Date: Sat, 8 May 2021 15:01:33 +0200 Subject: [PATCH 2/4] fix: disallow traversal when file and base dir share name --- src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs b/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs index 0572cec08..4958df41b 100644 --- a/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs +++ b/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs @@ -1,6 +1,7 @@ using ICSharpCode.SharpZipLib.Core; using System; using System.IO; +using System.Runtime.InteropServices; using System.Text; namespace ICSharpCode.SharpZipLib.Zip @@ -133,7 +134,9 @@ public string TransformFile(string name) { name = Path.Combine(_baseDirectory, name); - if (!_allowParentTraversal && !Path.GetFullPath(name).StartsWith(_baseDirectory, StringComparison.InvariantCultureIgnoreCase)) + var pathBase = Path.GetFullPath(_baseDirectory) + Path.DirectorySeparatorChar; + + if (!_allowParentTraversal && !Path.GetFullPath(name).StartsWith(pathBase, StringComparison.InvariantCultureIgnoreCase)) { throw new InvalidNameException("Parent traversal in paths is not allowed"); } From 2e3e2e8e43d3012d0888c14c6b6be727bbb68cae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?nils=20m=C3=A5s=C3=A9n?= Date: Sat, 8 May 2021 15:22:50 +0200 Subject: [PATCH 3/4] fix: use random file name for writing asciitrans tar entries --- src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs index 7bc770d17..3ae5f7757 100644 --- a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs +++ b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs @@ -824,7 +824,7 @@ private void WriteEntryCore(TarEntry sourceEntry, bool recurse) { if (!IsBinary(entryFilename)) { - tempFileName = Path.GetTempFileName(); + tempFileName = Path.GetRandomFileName(); using (StreamReader inStream = File.OpenText(entryFilename)) { From 4875a4502288e7a0e4b73a93ba0eda5998a696f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?nils=20m=C3=A5s=C3=A9n?= Date: Sat, 8 May 2021 15:35:24 +0200 Subject: [PATCH 4/4] fix: add dir separator to base dir if missing --- src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs b/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs index 4958df41b..43aa61403 100644 --- a/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs +++ b/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs @@ -134,7 +134,12 @@ public string TransformFile(string name) { name = Path.Combine(_baseDirectory, name); - var pathBase = Path.GetFullPath(_baseDirectory) + Path.DirectorySeparatorChar; + // Ensure base directory ends with directory separator ('/' or '\' depending on OS) + var pathBase = Path.GetFullPath(_baseDirectory); + if (pathBase[pathBase.Length - 1] != Path.DirectorySeparatorChar) + { + pathBase += Path.DirectorySeparatorChar; + } if (!_allowParentTraversal && !Path.GetFullPath(name).StartsWith(pathBase, StringComparison.InvariantCultureIgnoreCase)) {