Merge pull request #391 from jdleesmiller/fix-expand-path

Allow tilde in zip entry names
rubyzip · May 23, 2019 · ef516bd · ef516bd
2 parents 249775f + ad15c3c
commit ef516bd
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 1 deletion.
diff --git a/lib/zip/entry.rb b/lib/zip/entry.rb
@@ -118,7 +118,7 @@ def name_safe?
       return false unless cleanpath.relative?
       root = ::File::SEPARATOR
       naive_expanded_path = ::File.join(root, cleanpath.to_s)
-      cleanpath.expand_path(root).to_s == naive_expanded_path
+      ::File.absolute_path(cleanpath.to_s, root) == naive_expanded_path
     end
 
     def local_entry_offset #:nodoc:all

diff --git a/test/data/path_traversal/tilde.zip b/test/data/path_traversal/tilde.zip
diff --git a/test/path_traversal_test.rb b/test/path_traversal_test.rb
@@ -131,4 +131,11 @@ def test_entry_name_with_relative_symlink
       refute File.exist?('/tmp/file.txt')
     end
   end
+
+  def test_entry_name_with_tilde
+    in_tmpdir do
+      extract_path_traversal_zip 'tilde.zip'
+      assert File.exist?('~tilde~')
+    end
+  end
 end