• Elvis Angelaccio's avatar
    Fix vulnerability to path traversal attacks · 0df59252
    Elvis Angelaccio authored
    Ark was vulnerable to directory traversal attacks because of
    missing validation of file paths in the archive.
    
    More details about this attack are available at:
    https://github.com/snyk/zip-slip-vulnerability
    
    Job::onEntry() is the only place where we can safely check the path of
    every entry in the archive. There shouldn't be a valid reason
    to have a "../" in an archive path, so we can just play safe and abort
    the LoadJob if we detect such an entry. This makes impossibile to
    extract this kind of malicious archives and perform the attack.
    
    Thanks to Albert Astals Cid for suggesting to use QDir::cleanPath()
    so that we can still allow loading of legitimate archives that
    contain "../" in their paths but still resolve inside the extraction folder.
    0df59252
jobs.cpp 25.4 KB