Santize loaded filenames

dist/jszip.js

@@ -638,7 +638,10 @@ module.exports = function(data, options) {
     files = zipEntries.files;
     for (i = 0; i < files.length; i++) {
         input = files[i];
-        this.file(input.fileNameStr, input.decompressed, {
+        var unsafeName = input.fileNameStr;
+        var safeName = utils.resolve(input.fileNameStr);
+
+        this.file(safeName, input.decompressed, {
             binary: true,
             optimizedBinaryString: true,
             date: input.date,
@@ -648,6 +651,10 @@ module.exports = function(data, options) {
             dosPermissions : input.dosPermissions,
             createFolders: options.createFolders
         });
+
+        if (!input.dir) {
+            this.file(safeName).unsafeOriginalName = unsafeName;
+        }
     }
     if (zipEntries.zipComment.length) {
         this.comment = zipEntries.zipComment;
@@ -2197,6 +2204,31 @@ exports.transformTo = function(outputType, input) {
     return result;
 };
 
+/**
+ * Resolve all relative path components, "." and "..", in a path. If these relative components
+ * traverse above the root then the resulting path will only contain the final path component.
+ *
+ * All empty components, e.g. "//", are removed.
+ * @param {string} path A path with / or \ separators
+ * @returns {string} The path with all relative path components resolved.
+ */
+exports.resolve = function(path) {
+    var parts = path.split("/");
+    var result = [];
+    for (var index = 0; index < parts.length; index++) {
+        var part = parts[index];
+        // Allow the first and last component to be empty for trailing slashes.
+        if (part === "." || (part === "" && index !== 0 && index !== parts.length - 1)) {
+            continue;
+        } else if (part === "..") {
+            result.pop();
+        } else {
+            result.push(part);
+        }
+    }
+    return result.join("/");
+};
+
 /**
  * Return the type of the input.
  * The type will be in a format valid for JSZip.utils.transformTo : string, array, uint8array, arraybuffer.

lib/load.js

@@ -20,7 +20,10 @@ module.exports = function(data, options) {
     files = zipEntries.files;
     for (i = 0; i < files.length; i++) {
         input = files[i];
-        this.file(input.fileNameStr, input.decompressed, {
+        var unsafeName = input.fileNameStr;
+        var safeName = utils.resolve(input.fileNameStr);
+
+        this.file(safeName, input.decompressed, {
             binary: true,
             optimizedBinaryString: true,
             date: input.date,
@@ -30,6 +33,10 @@ module.exports = function(data, options) {
             dosPermissions : input.dosPermissions,
             createFolders: options.createFolders
         });
+
+        if (!input.dir) {
+            this.file(safeName).unsafeOriginalName = unsafeName;
+        }
     }
     if (zipEntries.zipComment.length) {
         this.comment = zipEntries.zipComment;

lib/utils.js

@@ -245,6 +245,31 @@ exports.transformTo = function(outputType, input) {
     return result;
 };
 
+/**
+ * Resolve all relative path components, "." and "..", in a path. If these relative components
+ * traverse above the root then the resulting path will only contain the final path component.
+ *
+ * All empty components, e.g. "//", are removed.
+ * @param {string} path A path with / or \ separators
+ * @returns {string} The path with all relative path components resolved.
+ */
+exports.resolve = function(path) {
+    var parts = path.split("/");
+    var result = [];
+    for (var index = 0; index < parts.length; index++) {
+        var part = parts[index];
+        // Allow the first and last component to be empty for trailing slashes.
+        if (part === "." || (part === "" && index !== 0 && index !== parts.length - 1)) {
+            continue;
+        } else if (part === "..") {
+            result.pop();
+        } else {
+            result.push(part);
+        }
+    }
+    return result.join("/");
+};
+
 /**
  * Return the type of the input.
  * The type will be in a format valid for JSZip.utils.transformTo : string, array, uint8array, arraybuffer.