From 5c3b293de5d65b108e7f2cd0ea8f81c1b8273f78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?nils=20m=C3=A5s=C3=A9n?= Date: Sat, 18 Sep 2021 11:58:11 +0200 Subject: [PATCH] fix: specialized tar extract traversal --- src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs index 4b373fb64..aa482cc06 100644 --- a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs +++ b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs @@ -658,8 +658,9 @@ private void ExtractEntry(string destDir, TarEntry entry, bool allowParentTraver name = name.Replace('/', Path.DirectorySeparatorChar); string destFile = Path.Combine(destDir, name); + var destFileDir = Path.GetDirectoryName(Path.GetFullPath(destFile)) ?? ""; - if (!allowParentTraversal && !Path.GetFullPath(destFile).StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase)) + if (!allowParentTraversal && !destFileDir.StartsWith(destDir, StringComparison.InvariantCultureIgnoreCase)) { throw new InvalidNameException("Parent traversal in paths is not allowed"); }