feat: implement safe path extraction for zip file entries

Author: yumao233

main.go

@@ -100,24 +100,23 @@ func UnZip(distDirPath, zipPath string) error {
 
 	defer zipFile.Close()
 
-	prefix := ""
-	if distDirPath != "" && distDirPath != "." {
-		prefix = distDirPath + "/"
-	}
-
 	for _, f := range zipFile.File {
 		nameReader := bytes.NewReader([]byte(f.Name))
 		decoder := transform.NewReader(nameReader, getDecoderByCoder(encode))
 		content, _ := ioutil.ReadAll(decoder)
 		filePath := string(content)
+		destPath, err := safeExtractPath(distDirPath, filePath)
+		if err != nil {
+			return err
+		}
 		if f.FileInfo().IsDir() {
-			_ = os.MkdirAll(prefix+filePath, os.ModePerm)
+			_ = os.MkdirAll(destPath, os.ModePerm)
 			continue
 		}
-		if err := os.MkdirAll(prefix+filepath.Dir(filePath), os.ModePerm); err != nil {
+		if err := os.MkdirAll(filepath.Dir(destPath), os.ModePerm); err != nil {
 			return err
 		}
-		dstFile, err := os.OpenFile(prefix+filePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
+		dstFile, err := os.OpenFile(destPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
 		if err != nil {
 			return err
 		}

utils.go

@@ -2,8 +2,11 @@ package main
 
 import (
 	"archive/zip"
+	"fmt"
 	"io"
 	"os"
+	"path"
+	"path/filepath"
 	"strings"
 
 	"golang.org/x/text/encoding"
@@ -32,6 +35,39 @@ func getDecoderByCoder(code string) *encoding.Decoder {
 	return decoder
 }
 
+// safeExtractPath resolves a zip entry name under baseDir and rejects path traversal.
+func safeExtractPath(baseDir, name string) (string, error) {
+	name = path.Clean(strings.ReplaceAll(name, "\\", "/"))
+	if name == "." || name == ".." {
+		return "", fmt.Errorf("illegal path: %q", name)
+	}
+	if strings.HasPrefix(name, "/") {
+		return "", fmt.Errorf("illegal absolute path: %q", name)
+	}
+	for _, part := range strings.Split(name, "/") {
+		if part == ".." {
+			return "", fmt.Errorf("illegal path traversal: %q", name)
+		}
+	}
+
+	if baseDir == "" || baseDir == "." {
+		baseDir = "."
+	}
+	baseAbs, err := filepath.Abs(baseDir)
+	if err != nil {
+		return "", err
+	}
+	destAbs, err := filepath.Abs(filepath.Join(baseAbs, filepath.FromSlash(name)))
+	if err != nil {
+		return "", err
+	}
+	baseWithSep := baseAbs + string(filepath.Separator)
+	if destAbs != baseAbs && !strings.HasPrefix(destAbs, baseWithSep) {
+		return "", fmt.Errorf("illegal path escapes destination: %q", name)
+	}
+	return destAbs, nil
+}
+
 func fileToZipWriter(file *os.File, prefix string, zw *zip.Writer) error {
 	info, err := file.Stat()
 	if err != nil {