Skip bundle entries that do not contain a plain relative path.

GomerPubs · Dec 5, 2022 · 2a47bef · 2a47bef
1 parent 6855f58
commit 2a47bef
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/ICSharpCode.ILSpyCmd/IlspyCmdProgram.cs b/ICSharpCode.ILSpyCmd/IlspyCmdProgram.cs
@@ -342,6 +342,12 @@ int DumpPackageAssemblies(string packageFileName, string outputDirectory, Comman
 					{
 						Stream contents;
 
+						if (entry.RelativePath.Replace('\\', '/').Contains("../", StringComparison.Ordinal))
+						{
+							app.Error.WriteLine($"Skipping single-file entry '{entry.RelativePath}' because it might refer to a location outside of the bundle output directory.");
+							continue;
+						}
+
 						if (entry.CompressedSize == 0)
 						{
 							contents = new UnmanagedMemoryStream(packageView.SafeMemoryMappedViewHandle, entry.Offset, entry.Size);