core: sanitizing the dirpath could cause issues with certain path formats (ie ../) that may be valid otherwise.

Author: ctalkington

lib/core.js

@@ -382,15 +382,9 @@ Archiver.prototype.directory = function(dirpath, destpath, data) {
 
   this._pending++;
 
-  dirpath = util.sanitizePath(dirpath);
-  dirpath = util.trailingSlashIt(dirpath);
-
-  if (typeof destpath === 'string') {
-    destpath = util.sanitizePath(destpath);
-    destpath = destpath === '' ? '' : util.trailingSlashIt(destpath);
-  } else if (destpath === false) {
+  if (destpath === false) {
     destpath = '';
-  } else {
+  } else if (typeof destpath !== 'string'){
     destpath = dirpath;
   }
 
@@ -406,7 +400,7 @@ Archiver.prototype.directory = function(dirpath, destpath, data) {
     } else {
       results.forEach(function(file) {
         var entryData = util._.extend({}, data);
-        entryData.name = destpath + file.relative;
+        entryData.name = util.sanitizePath(destpath, file.relative);
         entryData.stats = file.stats;
 
         self._append(file.path, entryData);

lib/util/index.js

@@ -105,9 +105,6 @@ util.unixifyPath = function() {
 util.walkdir = function(dirpath, base, callback) {
   var results = [];
 
-  dirpath = util.sanitizePath(dirpath);
-  dirpath = util.trailingSlashIt(dirpath);
-
   if (typeof base === 'function') {
     callback = base;
     base = dirpath;
@@ -116,6 +113,7 @@ util.walkdir = function(dirpath, base, callback) {
   fs.readdir(dirpath, function(err, list) {
     var i = 0;
     var file;
+    var filepath;
 
     if (err) {
       return callback(err);
@@ -128,15 +126,17 @@ util.walkdir = function(dirpath, base, callback) {
         return callback(null, results);
       }
 
-      fs.stat(dirpath + file, function (err, stats) {
+      filepath = path.join(dirpath, file);
+
+      fs.stat(filepath, function(err, stats) {
         results.push({
-          path: dirpath + file,
-          relative: path.relative(base, dirpath + file).replace(/\\/g, '/'),
+          path: filepath,
+          relative: path.relative(base, filepath).replace(/\\/g, '/'),
           stats: stats
         });
 
         if (stats && stats.isDirectory()) {
-          util.walkdir(dirpath + file, base, function(err, res) {
+          util.walkdir(filepath, base, function(err, res) {
             results = results.concat(res);
             next();
           });