fix: https://github.com/igoogolx/itun2socks/security/code-scanning/1

igoogolx · Jun 22, 2024 · 68d25f4 · 68d25f4
1 parent 84195fc
commit 68d25f4
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/scripts/generate.go b/scripts/generate.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 func main() {
@@ -109,6 +110,9 @@ func unarchiveFile(archiveFilePath string) error {
 		if err != nil {
 			return err
 		}
+		if strings.Contains(header.Name, "..") {
+			return fmt.Errorf("invalid file name: %s", header.Name)
+		}
 		outputPath := filepath.Join(parentDir, header.Name)
 		err = os.RemoveAll(outputPath)
 		if err != nil {