cenkalti / rain / 27305238865

41%

push

github

reject tar entries that escape destination dir in move-torrent

readData extracted tar entries from the /move-torrent request body using
filepath.Join(dir, hdr.Name) without verifying the result stayed within
the destination directory. A header name containing .. segments could
escape dir and write an arbitrary file as the daemon user (tar slip).
Reject any entry whose cleaned path falls outside dir before creating
directories or files.

0 of 7 new or added lines in 1 file covered. (0.0%)

3774 of 11776 relevant lines covered (32.05%)

47.66 hits per line