generic protection against bad zip files
Massimo Melina committed
Jul 2, 2026 at 13:06 UTC
371e1a86d2bc1676afcc1ad6fcf7807324bd0514
1 file changed
+2
src/util-files.ts
+2
@@ -100,6 +100,8 @@ export async function unzip(stream: Readable, cb: (path: string) => Promisable<f
100
.on('entry', (entry: any) =>
101
chain = chain.then(async () => {
102
const { path, type } = entry
103
+ if (hasDirTraversal(path))
104
+ return entry.autodrain().promise()
105
const dest = await try_(() => cb(path), e => console.warn(String(e)))
106
if (!dest || type !== 'File')
107
return entry.autodrain().promise()