[patch] CVE-2020-16116 patch

ark-path-traversal-CVE-2020-16116.patch (text/plain), 689 bytes, created by kevinmbecause on 2020-07-31 02:33:26 UTC

--- ./kerfuffle/jobs.cpp.old	2020-03-01 04:37:45.000000000 -0500
+++ ./kerfuffle/jobs.cpp	2020-07-30 22:19:08.857513920 -0400
@@ -181,6 +181,14 @@
 
 void Job::onEntry(Archive::Entry *entry)
 {
+    const QString entryFullPath = entry->fullPath();
+    if (QDir::cleanPath(entryFullPath).contains(QLatin1String("../"))) {
+        qCWarning(ARK) << "Possibly malicious archive. Detected entry that could lead to a directory traversal attack:" << entryFullPath;
+        onError(i18n("Could not load the archive because it contains ill-formed entries and might be a malicious archive."), QString());
+        onFinished(false);
+        return;
+    }
+    
     emit newEntry(entry);
 }