mirror of
https://github.com/rclone/rclone.git
synced 2026-10-09 14:39:28 -04:00
Nick Craig-Wood
96f298bdec
Whether an archive entry name can escape the archive's namespace was left entirely to each archiver. Enforce it in the archive backend too. List only passes on direct children of the directory listed and NewObject only returns the object asked for, so a future archiver which forgets to validate names cannot expose a traversal to fs/sync and fs/operations. (cherry picked from commit a6a7d95e081b91231b49c4004e8a2bff16da4cd8)