Merge pull request #9420 from okatu-loli/fix/archive-decomposs

feat(iso9660): Refactor path handling for secure file extraction

Author: JoaHuang

internal/archive/iso9660/iso9660.go

@@ -1,14 +1,14 @@
 package iso9660
 
 import (
+	"io"
+	"os"
+
 	"github.com/alist-org/alist/v3/internal/archive/tool"
 	"github.com/alist-org/alist/v3/internal/errs"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/stream"
 	"github.com/kdomanski/iso9660"
-	"io"
-	"os"
-	stdpath "path"
 )
 
 type ISO9660 struct {
@@ -78,7 +78,10 @@ func (ISO9660) Decompress(ss []*stream.SeekableStream, outputPath string, args m
 	}
 	if obj.IsDir() {
 		if args.InnerPath != "/" {
-			outputPath = stdpath.Join(outputPath, obj.Name())
+			outputPath, err = tool.SecureJoin(outputPath, obj.Name())
+			if err != nil {
+				return err
+			}
 			if err = os.MkdirAll(outputPath, 0700); err != nil {
 				return err
 			}

internal/archive/iso9660/utils.go

@@ -1,10 +1,12 @@
 package iso9660
 
 import (
+	"io"
 	"os"
-	stdpath "path"
+	"path/filepath"
 	"strings"
 
+	"github.com/alist-org/alist/v3/internal/archive/tool"
 	"github.com/alist-org/alist/v3/internal/errs"
 	"github.com/alist-org/alist/v3/internal/model"
 	"github.com/alist-org/alist/v3/internal/stream"
@@ -62,15 +64,26 @@ func toModelObj(file *iso9660.File) model.Obj {
 }
 
 func decompress(f *iso9660.File, path string, up model.UpdateProgress) error {
-	file, err := os.OpenFile(stdpath.Join(path, f.Name()), os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	return decompressEntry(f.Reader(), f.Size(), path, f.Name(), up)
+}
+
+func decompressEntry(reader io.Reader, size int64, path, entryName string, up model.UpdateProgress) error {
+	dstPath, err := tool.SecureJoin(path, entryName)
+	if err != nil {
+		return err
+	}
+	if err = os.MkdirAll(filepath.Dir(dstPath), 0700); err != nil {
+		return err
+	}
+	file, err := os.OpenFile(dstPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
 	if err != nil {
 		return err
 	}
 	defer file.Close()
 	_, err = utils.CopyWithBuffer(file, &stream.ReaderUpdatingProgress{
 		Reader: &stream.SimpleReaderWithSize{
-			Reader: f.Reader(),
-			Size:   f.Size(),
+			Reader: reader,
+			Size:   size,
 		},
 		UpdateProgress: up,
 	})
@@ -84,7 +97,10 @@ func decompressAll(children []*iso9660.File, path string) error {
 			if err != nil {
 				return err
 			}
-			nextPath := stdpath.Join(path, child.Name())
+			nextPath, err := tool.SecureJoin(path, child.Name())
+			if err != nil {
+				return err
+			}
 			if err = os.MkdirAll(nextPath, 0700); err != nil {
 				return err
 			}