fix: check for parent dir reference when extracting cache (#251)

Fixes #235
blinklabs-io · Jun 11, 2024 · 9662c2e · 9662c2e
1 parent 6f92468
commit 9662c2e
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/pkgmgr/registry.go b/pkgmgr/registry.go
@@ -170,6 +170,10 @@ func registryPackagesUrl(cfg Config, validate bool) ([]Package, error) {
 			if (zipFile.Mode() & fs.ModeDir) > 0 {
 				continue
 			}
+			// Ensure there are no parent dir references in path
+			if strings.Contains(zipFile.Name, "..") {
+				continue
+			}
 			outPath := filepath.Join(
 				cachePath,
 				zipFile.Name,