In our image header.Name cannot contain ..

uniget-org · Oct 13, 2023 · a85e218 · a85e218
1 parent b5e5a56
commit a85e218
Showing 1 changed file with 3 additions and 4 deletions.
diff --git a/pkg/archive/new.go b/pkg/archive/new.go
@@ -60,10 +60,9 @@ func ExtractTarGz(gzipStream io.Reader) error {
 			return fmt.Errorf("ExtractTarGz: Next() failed: %s", err.Error())
 		}
 
-		// TODO: Check if this is really necessary
-		//if strings.Contains(header.Name, "..") {
-		//	return fmt.Errorf("ExtractTarGz: filename contains '..': %s", header.Name)
-		//}
+		if strings.Contains(header.Name, "..") {
+			return fmt.Errorf("ExtractTarGz: filename contains '..': %s", header.Name)
+		}
 
 		switch header.Typeflag {
 		case tar.TypeDir: