Browse Source

Also reject absolute paths in bundle decompression

pull/2871/head
Daniel Grunwald 3 years ago
parent
commit
448fe3065e
  1. 2
      ICSharpCode.ILSpyCmd/IlspyCmdProgram.cs

2
ICSharpCode.ILSpyCmd/IlspyCmdProgram.cs

@ -342,7 +342,7 @@ Examples: @@ -342,7 +342,7 @@ Examples:
{
Stream contents;
if (entry.RelativePath.Replace('\\', '/').Contains("../", StringComparison.Ordinal))
if (entry.RelativePath.Replace('\\', '/').Contains("../", StringComparison.Ordinal) || Path.IsPathRooted(entry.RelativePath))
{
app.Error.WriteLine($"Skipping single-file entry '{entry.RelativePath}' because it might refer to a location outside of the bundle output directory.");
continue;

Loading…
Cancel
Save