mirror of
https://github.com/zlib-ng/minizip-ng
synced 2026-08-25 14:26:08 -04:00
131d59ba39
Symlink archive entries had their stored target passed directly to mz_os_make_symlink without checking containment, so a malicious archive could create a link pointing outside the extraction root. Add mz_path_is_symlink_target_safe to verify a link target resolves within the destination directory, and apply it to both the UNIX1 extrafield and entry-content link targets. Reject symlink entries outright when no destination base is set, since the target cannot be validated without one. Assisted-By: Claude Opus 4.8 |
||
|---|---|---|
| .. | ||
| fuzz | ||
| CMakeLists.txt | ||
| empty.txt | ||
| random.bin | ||
| single.txt | ||
| test.p12 | ||
| test.pem | ||
| test_compat.cc | ||
| test_crypt.cc | ||
| test_encoding.cc | ||
| test_file.cc | ||
| test_main.cc | ||
| test_path.cc | ||
| test_stream.cc | ||
| test_stream_compress.cc | ||
| test_stream_crypt.cc | ||
| uniform.bin | ||