amorfo77/docker-minecraft-server
1
0
Fork 0
mirror of https://github.com/itzg/docker-minecraft-server.git synced 2026-08-29 18:27:33 +00:00
Code Issues Projects Releases Wiki Activity

pin gosu, fail closed on BuildTools download, reject zip slip (#4247)

Browse Source
This commit is contained in:
LCB
2026-08-27 12:38:41 -05:00
committed by GitHub
parent 6417a93920
commit 6d6c99ff6b
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/start-utils
+12
View File
@@ -579,12 +579,24 @@ function extract() {
case "${type}" in
application/zip)
if unzip -Z1 "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
logError "Refusing to extract $src because it contains path traversal entries"
return 1
fi
unzip -o -q -d "${destDir}" "${src}" "$@"
;;
application/x-tar | application/gzip | application/x-gzip | application/x-bzip2)
if tar -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
logError "Refusing to extract $src because it contains path traversal entries"
return 1
fi
tar -C "${destDir}" -xf "${src}" "$@"
;;
application/zstd | application/x-zstd)
if tar --use-compress-program=unzstd -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
logError "Refusing to extract $src because it contains path traversal entries"
return 1
fi
tar -C "${destDir}" --use-compress-program=unzstd -xf "${src}" "$@"
;;
*)