Skip to content

fix: reject path traversal in backup restore - #128

Merged
SingLinkNetwork merged 4 commits into
mainfrom
fix/zip-slip
Aug 10, 2026
Merged

fix: reject path traversal in backup restore#128
SingLinkNetwork merged 4 commits into
mainfrom
fix/zip-slip

Conversation

@SingLinkNetwork

Copy link
Copy Markdown
Owner

Fixes #113.

  • validates every ZIP entry before creating any restore output
  • rejects traversal, absolute, backslash, and drive-prefixed paths
  • preserves valid nested backup entries and stream cleanup

Local verification: full Flutter test suite and changed-file analysis passed.

@SingLinkNetwork
SingLinkNetwork marked this pull request as ready for review August 10, 2026 13:44
@SingLinkNetwork
SingLinkNetwork merged commit 08b8c6d into main Aug 10, 2026
63 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] 還原備份未阻擋 ZIP 路徑穿越

1 participant