blob: 29f035a3c9fc55409edf1af30cec06b9c7b95b88 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
Fix for https://www.kde.org/info/security/advisory-20170227-1.txt
--- ktnef/ktnefparser.cpp.orig 2017-03-11 20:23:43 UTC
+++ ktnef/ktnefparser.cpp
@@ -40,7 +40,9 @@
#include <QtCore/QDateTime>
#include <QtCore/QDataStream>
+#include <QtCore/QDir>
#include <QtCore/QFile>
+#include <QtCore/QFileInfo>
#include <QtCore/QVariant>
#include <QtCore/QList>
@@ -446,7 +448,9 @@ bool KTNEFParser::extractFile( const QSt
bool KTNEFParser::ParserPrivate::extractAttachmentTo( KTNEFAttach *att,
const QString &dirname )
{
- QString filename = dirname + '/';
+ const QString destDir( QDir( dirname ).absolutePath() ); // get directory path without any "." or ".."
+
+ QString filename = destDir + '/';
if ( !att->fileName().isEmpty()) {
filename += att->fileName();
} else {
@@ -462,6 +466,13 @@ bool KTNEFParser::ParserPrivate::extract
if ( !device_->seek( att->offset() ) ) {
return false;
}
+ const QFileInfo fi( filename );
+ if ( !fi.absoluteFilePath().startsWith( destDir ) ) {
+ kWarning() << "Attempted extract into" << fi.absoluteFilePath()
+ << "which is outside of the extraction root folder" << destDir << "."
+ << "Changing export of contained files to extraction root folder.";
+ filename = destDir + QLatin1Char( '/' ) + fi.fileName();
+ }
KSaveFile outfile( filename );
if ( !outfile.open() ) {
return false;
|
