go: fix bug in zip-slip example fix

smowton · web-flow · commit 5799287a2b1b · 2022-12-14T13:51:32.000Z
diff --git a/go/ql/src/Security/CWE-022/ZipSlipGood.go b/go/ql/src/Security/CWE-022/ZipSlipGood.go
@@ -12,7 +12,7 @@ func unzipGood(f string) {
 	for _, f := range r.File {
 		p, _ := filepath.Abs(f.Name)
 		// GOOD: Check that path does not contain ".." before using it
-		if !strings.Contains(p, "..") {
+		if !strings.Contains(f.Name, "..") {
 			ioutil.WriteFile(p, []byte("present"), 0666)
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ func unzipGood(f string) {`
`12`	`12`	`for _, f := range r.File {`
`13`	`13`	`p, _ := filepath.Abs(f.Name)`
`14`	`14`	`// GOOD: Check that path does not contain ".." before using it`
`15`		`- if !strings.Contains(p, "..") {`
	`15`	`+ if !strings.Contains(f.Name, "..") {`
`16`	`16`	`ioutil.WriteFile(p, []byte("present"), 0666)`
`17`	`17`	`}`
`18`	`18`	`}`