From ad15c3c49464097390248220fd93ce4caa8f43e3 Mon Sep 17 00:00:00 2001
From: John Lees-Miller <jdleesmiller@gmail.com>
Date: Sun, 3 Mar 2019 14:46:49 +0000
Subject: [PATCH] Allow tilde in zip entry names

Use absolute_path rather than expand_path to allow tilde to pass through
unchanged. Otherwise, we try to expand it to a home directory.
---
 lib/zip/entry.rb                   |   2 +-
 test/data/path_traversal/tilde.zip | Bin 0 -> 577 bytes
 test/path_traversal_test.rb        |   7 +++++++
 3 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 test/data/path_traversal/tilde.zip

diff --git a/lib/zip/entry.rb b/lib/zip/entry.rb
index a98c0772..80160b57 100644
--- a/lib/zip/entry.rb
+++ b/lib/zip/entry.rb
@@ -118,7 +118,7 @@ def name_safe?
       return false unless cleanpath.relative?
       root = ::File::SEPARATOR
       naive_expanded_path = ::File.join(root, cleanpath.to_s)
-      cleanpath.expand_path(root).to_s == naive_expanded_path
+      ::File.absolute_path(cleanpath.to_s, root) == naive_expanded_path
     end
 
     def local_entry_offset #:nodoc:all
diff --git a/test/data/path_traversal/tilde.zip b/test/data/path_traversal/tilde.zip
new file mode 100644
index 0000000000000000000000000000000000000000..0442ab93701831639904d7f1c1538cc476c18dbe
GIT binary patch
literal 577
zcmWIWW@Zs#-~d9~%0xc~B*4xfz))9`nUj)Q7aGCCu;fm4jGK35%vVMc2JMq)JUyQ>
zF$8$Cb9`Q=RLlX?#s<UzK*PAeM%>IxMlp;NXjpu_ucNbnaD+a{xRpTTKp12kNE>!H
z2qA0Ji^t)d<OI>=^n|2@557KOANa#M0vebmNHD7lNHcy^QegYI-avp=#@VT9fzO0K
zNr#-~Wi5h=db8%tUp+k{V8Y~8;SsYUrpySRG;{i?fED=(35glGvvTH5nUs^0^>$9+
zl=-u>auc7VJ$&`-*|O{xZ=S8le)KGD#p{%em#eb#o;=G)c#x9!Amha$knh<!T0@1M
z+JPZ(1socTOrp#Pk0FN?I|C0moPdPGl12~{?l%s2PzQK}48Rqj2m}5)`T`9=3SJI)
l@Is70xB=OHLMU!%K{f&@sF9t+3W{U~W+1!(q@x)@JOE^>oUs4^

literal 0
HcmV?d00001

diff --git a/test/path_traversal_test.rb b/test/path_traversal_test.rb
index 9a361a59..e5bdd722 100644
--- a/test/path_traversal_test.rb
+++ b/test/path_traversal_test.rb
@@ -131,4 +131,11 @@ def test_entry_name_with_relative_symlink
       refute File.exist?('/tmp/file.txt')
     end
   end
+
+  def test_entry_name_with_tilde
+    in_tmpdir do
+      extract_path_traversal_zip 'tilde.zip'
+      assert File.exist?('~tilde~')
+    end
+  end
 end