security: clean file path on extracting

Reported by George Gkitsas.

Author: unknwon

cae.go

@@ -18,6 +18,7 @@ package cae
 import (
 	"io"
 	"os"
+	"path"
 	"strings"
 )
 
@@ -106,3 +107,8 @@ func Copy(dest, src string) error {
 	}
 	return os.Chmod(dest, si.Mode())
 }
+
+// Clean cleans up given path and returns a relative path that goes straight down.
+func Clean(p string) string {
+	return strings.Trim(path.Clean("/"+p), "/")
+}

tz/read.go

@@ -20,6 +20,8 @@ import (
 	"io"
 	"os"
 	"strings"
+
+	"github.com/unknwon/cae"
 )
 
 // A ReadCloser represents a caller closable file reader.
@@ -88,7 +90,7 @@ func (tz *TzArchive) syncFiles() {
 	for i, f := range tz.File {
 		tz.files[i] = &File{}
 		tz.files[i].Header = f
-		tz.files[i].Name = strings.Replace(f.Name, "\\", "/", -1)
+		tz.files[i].Name = cae.Clean(strings.ReplaceAll(f.Name, "\\", "/"))
 		if f.FileInfo().IsDir() && !strings.HasSuffix(tz.files[i].Name, "/") {
 			tz.files[i].Name += "/"
 		}

tz/write.go

@@ -69,7 +69,7 @@ var defaultExtractFunc = func(fullName string, fi os.FileInfo) error {
 // specified destination.
 // It accepts a function as a middleware for custom operations.
 func (tz *TzArchive) ExtractToFunc(destPath string, fn cae.HookFunc, entries ...string) (err error) {
-	destPath = strings.Replace(destPath, "\\", "/", -1)
+	destPath = strings.ReplaceAll(destPath, "\\", "/")
 	isHasEntry := len(entries) > 0
 	if Verbose {
 		fmt.Println("Extracting " + tz.FileName + "...")
@@ -103,7 +103,7 @@ func (tz *TzArchive) ExtractToFunc(destPath string, fn cae.HookFunc, entries ...
 			return err
 		}
 
-		h.Name = strings.Replace(h.Name, "\\", "/", -1)
+		h.Name = cae.Clean(strings.ReplaceAll(h.Name, "\\", "/"))
 
 		// Directory.
 		if h.Typeflag == tar.TypeDir {

zip/read.go

@@ -18,6 +18,8 @@ import (
 	"archive/zip"
 	"os"
 	"strings"
+
+	"github.com/unknwon/cae"
 )
 
 // OpenFile is the generalized open call; most users will use Open
@@ -58,7 +60,7 @@ func (z *ZipArchive) Open(name string, flag int, perm os.FileMode) error {
 		if err != nil {
 			return err
 		}
-		z.files[i].Name = strings.Replace(f.Name, "\\", "/", -1)
+		z.files[i].Name = cae.Clean(strings.ReplaceAll(f.Name, "\\", "/"))
 		if f.FileInfo().IsDir() && !strings.HasSuffix(z.files[i].Name, "/") {
 			z.files[i].Name += "/"
 		}

zip/write.go

@@ -81,7 +81,7 @@ func (z *ZipArchive) ExtractToFunc(destPath string, fn cae.HookFunc, entries ...
 	}
 	os.MkdirAll(destPath, os.ModePerm)
 	for _, f := range z.File {
-		f.Name = strings.Replace(f.Name, "\\", "/", -1)
+		f.Name = cae.Clean(strings.ReplaceAll(f.Name, "\\", "/"))
 
 		// Directory.
 		if strings.HasSuffix(f.Name, "/") {