| 121 | } |
| 122 | |
| 123 | bool isSafeZipRelativePath(const std::string& relPath) |
| 124 | { |
| 125 | if (relPath.empty()) { |
| 126 | return false; |
| 127 | } |
| 128 | if (relPath.front() == '/' || relPath.front() == '\\') { |
| 129 | return false; |
| 130 | } |
| 131 | if (relPath.find('\\') != std::string::npos) { |
| 132 | return false; |
| 133 | } |
| 134 | if (relPath.find(':') != std::string::npos) { |
| 135 | return false; |
| 136 | } |
| 137 | |
| 138 | size_t start = 0; |
| 139 | while (start <= relPath.size()) { |
| 140 | size_t pos = relPath.find('/', start); |
| 141 | size_t len = (pos == std::string::npos) ? relPath.size() - start : pos - start; |
| 142 | std::string part = relPath.substr(start, len); |
| 143 | if (part == "..") { |
| 144 | return false; |
| 145 | } |
| 146 | if (pos == std::string::npos) { |
| 147 | break; |
| 148 | } |
| 149 | start = pos + 1; |
| 150 | } |
| 151 | |
| 152 | return true; |
| 153 | } |
| 154 | |
| 155 | std::string sanitizeFileName(const std::string& name) |
| 156 | { |