Ark was vulnerable to directory traversal attacks because of
missing validation of file paths in the archive.

More details about this attack are available at:
https://github.com/snyk/zip-slip-vulnerability

Job::onEntry() is the only place where we can safely check the path of
every entry in the archive. There shouldn't be a valid reason
to have a "../" in an archive path, so we can just play safe and abort
the LoadJob if we detect such an entry. This makes impossibile to
extract this kind of malicious archives and perform the attack.

Thanks to Albert Astals Cid for suggesting to use QDir::cleanPath()
so that we can still allow loading of legitimate archives that
contain "../" in their paths but still resolve inside the extraction folder.

Ragnar, Elvis, please remember to do the merges, if it wasn't because I'm
stubborn when creating new branches we would have lost this for 20.08
and future because the code was only in 20.04

CCMAIL: rthomsen6@gmail.com
CCMAIL: elvis.angelaccio@kde.org

(cherry picked from commit f028568d)

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"

In case of conflict in i18n, keep the version of the branch "ours"
To resolve a particular conflict, "git checkout --ours path/to/file.desktop"

Timothée Ravier authored Jun 13, 2020 and Nate Graham committed Jun 13, 2020

* Add OARS content rating
* Update screenshot image size
* Update flatpak manifest

(cherry picked from commit 6e1344df)

(cherry picked from commit d42851d6)

Improves error-handling in LibarchivePlugin::list().

Previously we only checked whether we could read until the end of the
archive, and even if we couldn't there was no error shown to the user.
Now we check the return value of both archive_read_next_header() and
archive_read_data_skip(), and show a corrupt archive query if either
was not successful.

This partially solves bug 411074, as Ark now at least gives a warning
when opening a corrupt archive with libarchiveplugin. We still need to
improve error-handling when extracting, but this requires some
refactoring first so will be done later.
CCBUG: 411074
Differential Revision: D29383