github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-06 07:57:35 +00:00
Code Issues Projects Releases Wiki Activity

Fix a bug where malformed paths don't get written to the destination dir.

Browse Source
This commit is contained in:
Brendan Burns
2018-03-16 12:19:31 -07:00
parent 9fe565aba5
commit d196afabc4
2 changed files with 83 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/kubectl/cmd/cp.go
View File

@@ -312,6 +312,12 @@ func recursiveTar(srcBase, srcFile, destBase, destFile string, tw *tar.Writer) e
return nil
}
// clean prevents path traversals by stripping them out.
// This is adapted from https://golang.org/src/net/http/fs.go#L74
func clean(fileName string) string {
return path.Clean(string(os.PathSeparator) + fileName)
}
func untarAll(reader io.Reader, destFile, prefix string) error {
entrySeq := -1
@@ -327,7 +333,7 @@ func untarAll(reader io.Reader, destFile, prefix string) error {
}
entrySeq++
mode := header.FileInfo().Mode()
outFileName := path.Join(destFile, header.Name[len(prefix):])
outFileName := path.Join(destFile, clean(header.Name[len(prefix):]))
baseName := path.Dir(outFileName)
if err := os.MkdirAll(baseName, 0755); err != nil {
return err
@@ -346,7 +352,7 @@ func untarAll(reader io.Reader, destFile, prefix string) error {
return err
}
if exists {
outFileName = filepath.Join(outFileName, path.Base(header.Name))
outFileName = filepath.Join(outFileName, path.Base(clean(header.Name)))
}
}