Bug 1466872: Fix zip slip vulnerability

Ref: https://snyk.io/research/zip-slip-vulnerability
taskcluster · Jun 7, 2018 · 23e2a8f · 23e2a8f
1 parent 8cece2c
commit 23e2a8f
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/aws.go b/aws.go
@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"log"
@@ -150,6 +151,11 @@ func Unzip(b []byte, dest string) error {
 
 		path := filepath.Join(dest, f.Name)
 
+		// Fix for https://snyk.io/research/zip-slip-vulnerability
+		if !strings.HasPrefix(path, dest) {
+			return fmt.Errorf("%s: illegal path", f.Name)
+		}
+
 		if f.FileInfo().IsDir() {
 			os.MkdirAll(path, f.Mode())
 		} else {