diff --git a/src/providers/generic/zip/AdmZipProvider.ts b/src/providers/generic/zip/AdmZipProvider.ts index d12d14f99..001366325 100644 --- a/src/providers/generic/zip/AdmZipProvider.ts +++ b/src/providers/generic/zip/AdmZipProvider.ts @@ -24,9 +24,9 @@ export default class AdmZipProvider extends ZipProvider { async extractEntryTo(zip: string | Buffer, target: string, outputPath: string): Promise { const adm = new AdmZip(zip); - target = target.replace(/\\/g, '/'); + const safeTarget = target.replace(/\\/g, '/'); outputPath = outputPath.replace(/\\/g, '/'); - var fullPath = path.join(outputPath, target).replace(/\\/g, '/'); + var fullPath = path.join(outputPath, safeTarget).replace(/\\/g, '/'); if(!path.posix.normalize(fullPath).startsWith(outputPath)) { throw Error("Entry " + target + " would extract outside of expected folder");