PR icsharpcode#622

HowToDoThis · Aug 11, 2021 · 47fc2f5 · 47fc2f5
1 parent eb0c75e
commit 47fc2f5
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs b/src/ICSharpCode.SharpZipLib/Tar/TarArchive.cs
@@ -803,7 +803,7 @@ private void WriteEntryCore(TarEntry sourceEntry, bool recurse)
 			{
 				if (!IsBinary(entryFilename))
 				{
-					tempFileName = Path.GetTempFileName();
+					tempFileName = Path.GetRandomFileName();
 
 					using (StreamReader inStream = File.OpenText(entryFilename))
 					{

diff --git a/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs b/src/ICSharpCode.SharpZipLib/Zip/WindowsNameTransform.cs
@@ -133,7 +133,14 @@ public string TransformFile(string name)
 				{
 					name = Path.Combine(_baseDirectory, name);
 
-					if (!_allowParentTraversal && !Path.GetFullPath(name).StartsWith(_baseDirectory, StringComparison.InvariantCultureIgnoreCase))
+					// Ensure base directory ends with directory separator ('/' or '\' depending on OS)
+					var pathBase = Path.GetFullPath(_baseDirectory);
+					if (pathBase[pathBase.Length - 1] != Path.DirectorySeparatorChar)
+					{
+						pathBase += Path.DirectorySeparatorChar;
+					}
+
+					if (!_allowParentTraversal && !Path.GetFullPath(name).StartsWith(pathBase, StringComparison.InvariantCultureIgnoreCase))
 					{
 						throw new InvalidNameException("Parent traversal in paths is not allowed");
 					}