Nick Craig-Wood b88e237e8c archive: fix listing entries with a leading slash as if they were in the root ...

The check that an entry returned by an archiver is a direct child of
the directory being listed normalised a parent of "/" to the root, so
an entry named "/x" passed as a child of the root while "x/" and
"dir//x" were rejected.

Decide by stripping the directory prefix and checking what is left
with sanitize.Leaf, which rejects an empty name, ".", ".." and any
name containing a "/". This also covers the leading slash case.

2026-09-05 12:14:46 +01:00

..

archiver

archive: hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q

2026-09-04 19:00:22 +01:00

base

vfs: add context parameter to New() for config propagation

2026-04-13 12:48:38 +01:00

squashfs

archive: reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q

2026-09-04 19:00:22 +01:00

zip

archive: fix zip file entries named for a directory causing confusion

2026-09-05 12:14:46 +01:00

archive_internal_test.go

archive: fix listing entries with a leading slash as if they were in the root

2026-09-05 12:14:46 +01:00

archive_test.go

Archive backend to read archives on cloud storage.

2025-10-28 11:05:41 +00:00

archive_unsupported.go

Archive backend to read archives on cloud storage.

2025-10-28 11:05:41 +00:00

archive.go

archive: fix listing entries with a leading slash as if they were in the root

2026-09-05 12:14:46 +01:00

squashfs_malformed_test.go

archive/squashfs: don't crash on malformed squashfs images GHSA-6jcg-q3wp-x2f4 CVE-PENDING

2026-07-31 13:21:59 +01:00