Skip to content

Commit

Permalink
Also reject absolute paths in bundle decompression
Browse files Browse the repository at this point in the history
  • Loading branch information
dgrunwald committed Dec 18, 2022
1 parent a8308a1 commit 448fe30
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion ICSharpCode.ILSpyCmd/IlspyCmdProgram.cs
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,7 @@ int DumpPackageAssemblies(string packageFileName, string outputDirectory, Comman
{
Stream contents;

if (entry.RelativePath.Replace('\\', '/').Contains("../", StringComparison.Ordinal))
if (entry.RelativePath.Replace('\\', '/').Contains("../", StringComparison.Ordinal) || Path.IsPathRooted(entry.RelativePath))
{
app.Error.WriteLine($"Skipping single-file entry '{entry.RelativePath}' because it might refer to a location outside of the bundle output directory.");
continue;
Expand Down

0 comments on commit 448fe30

Please sign in to comment.