extract-zip@2.0.1.patch

diff --git a/index.js b/index.js
index 00105fe..ec8f5f2 100644
--- a/index.js
+++ b/index.js
@@ -127,5 +127,16 @@ class Extractor {
     if (symlink) {
       const link = await getStream(readStream)
+      const resolvedLink = path.resolve(path.dirname(dest), link)
+      const relativeLink = path.relative(this.opts.dir, resolvedLink)
+
+      if (
+        relativeLink === '..' ||
+        relativeLink.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relativeLink)
+      ) {
+        throw new Error(`Out of bound symlink "${link}" found while processing file ${entry.fileName}`)
+      }
+
       debug('creating symlink', link, dest)
       await fs.symlink(link, dest)
     } else {