--- ./kerfuffle/jobs.cpp.old 2020-03-01 04:37:45.000000000 -0500 +++ ./kerfuffle/jobs.cpp 2020-07-30 22:19:08.857513920 -0400 @@ -181,6 +181,14 @@ void Job::onEntry(Archive::Entry *entry) { + const QString entryFullPath = entry->fullPath(); + if (QDir::cleanPath(entryFullPath).contains(QLatin1String("../"))) { + qCWarning(ARK) << "Possibly malicious archive. Detected entry that could lead to a directory traversal attack:" << entryFullPath; + onError(i18n("Could not load the archive because it contains ill-formed entries and might be a malicious archive."), QString()); + onFinished(false); + return; + } + emit newEntry(entry); }