hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

add testing for complex path sanitizer in ZipSlip

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-05-19 10:17:15 +02:00
parent 0d762066f5
commit 5a5192b890
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
javascript/ql/test/query-tests/Security/CWE-022/ZipSlip/ZipSlipGood.js
View File

@@ -15,3 +15,17 @@ fs.createReadStream('archive.zip')
fs.createWriteStream(path.join(cwd, path.join('/', fileName)));
});
fs.createReadStream('archive.zip')
.pipe(unzip.Parse())
.on('entry', entry => {
const fileName = path.normalize(entry.path);
if (path.isAbsolute(fileName)) {
return;
}
if (!fileName.startsWith(".")) {
entry.pipe(fs.createWriteStream(fileName)); // OK.
}
});