diff --git a/lib/zip/entry.rb b/lib/zip/entry.rb index 37222a5..28d6009 100644 --- a/lib/zip/entry.rb +++ b/lib/zip/entry.rb @@ -154,6 +154,9 @@ module Zip elsif @name.squeeze('/') =~ /\.{2}(?:\/|\z)/ puts "WARNING: skipped \"../\" path component(s) in #{@name}" return self + elsif symlink? && get_input_stream.read =~ %r{../..} + puts "WARNING: skipped \"#{get_input_stream.read}\" symlink path in #{@name}" + return self end dest_path ||= @name diff --git a/test/data/symlink.zip b/test/data/symlink.zip new file mode 100644 index 0000000..e74ee19 Binary files /dev/null and b/test/data/symlink.zip differ diff --git a/test/entry_test.rb b/test/entry_test.rb index a75052e..eaa9c0d 100644 --- a/test/entry_test.rb +++ b/test/entry_test.rb @@ -177,4 +177,14 @@ class ZipEntryTest < MiniTest::Test assert File.exist?("#{path}/tmp/file.txt") end + + def test_entry_name_with_relative_symlink + assert_raises Errno::ENOENT do + Zip::File.open('test/data/symlink.zip') do |zip_file| + zip_file.each do |entry| + entry.extract + end + end + end + end end