| 373 | } |
| 374 | |
| 375 | func cleanZipName(name string) (string, error) { |
| 376 | if strings.TrimSpace(name) == "" { |
| 377 | return "", fmt.Errorf("zip entry has empty name") |
| 378 | } |
| 379 | if strings.Contains(name, `\`) { |
| 380 | return "", fmt.Errorf("zip entry %s uses backslash path separators", name) |
| 381 | } |
| 382 | if path.IsAbs(name) { |
| 383 | return "", fmt.Errorf("zip entry %s is absolute", name) |
| 384 | } |
| 385 | cleaned := path.Clean(name) |
| 386 | if cleaned == "." || cleaned == ".." || strings.HasPrefix(cleaned, "../") { |
| 387 | return "", fmt.Errorf("zip entry %s escapes archive root", name) |
| 388 | } |
| 389 | return cleaned, nil |
| 390 | } |
| 391 | |
| 392 | func regularZipFile(file *zip.File) bool { |
| 393 | mode := file.FileInfo().Mode() |