mirror of
https://github.com/adamhathcock/sharpcompress.git
synced 2026-02-03 21:23:38 +00:00
WriteEntryToDirectory - entry with root path crash #620
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @omermircor on GitHub (Apr 8, 2024).
Hi, When I call WriteEntryToDirectory with entry key that is rooted for example '/root/file.txt' and the directory '/root2' as param.
the code fails with Entry is trying to create a directory outside of the destination directory.
The reason for that is Path.Combine ignore the directory path param.
The solution should be move use Path.Join.
@adamhathcock commented on GitHub (Apr 9, 2024):
There was to avoid a specific vulnerability to not allow extraction outside the destination directory:
https://github.com/adamhathcock/sharpcompress/pull/374/files
Path.Join does not seem applicable.
@Ilanlido commented on GitHub (Apr 16, 2024):
@adamhathcock Hi, i would've assume that if my destination folder is /root2 and the directory inside the zip is for example /root/file.txt then it will be extracted to /root2/root/file.txt (just like if i extract the zip manually on my pc)
@adamhathcock commented on GitHub (Apr 16, 2024):
again, the linked PR prevents extraction to directories outside of the current one
@Ilanlido commented on GitHub (Apr 16, 2024):
I understand, again, i didn't expect it to extract to outside directories i'm expecting it to extract the full path into my desired destination folder - the problem is that when using Path.Combine("/root","/root2/test.txt") it will return "/root2/test.txt" instead of "/root/root2/test.txt"
@adamhathcock commented on GitHub (Apr 16, 2024):
These are just convenance methods. You don't have to use them. You can write your own to write entries to whatever you like and however you like.