actions/toolkit
2
0
Fork 0
mirror of https://github.com/actions/toolkit.git synced 2026-08-16 00:00:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent path traversal attacks

Browse Source
This commit is contained in:
Daniel Kennedy
2026-01-29 15:17:38 -05:00
parent e7359c0031
commit 3d05a1c31b
2 changed files with 82 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/artifact/src/internal/download/download-artifact.ts
+3 -1
View File
@@ -93,7 +93,9 @@ export async function streamExtractExternal(
/filename\*?=['"]?(?:UTF-\d['"]*)?([^;\r\n"']*)['"]?/i
)
if (filenameMatch && filenameMatch[1]) {
fileName = decodeURIComponent(filenameMatch[1].trim())
// Sanitize fileName to prevent path traversal attacks
// Use path.basename to extract only the filename component
fileName = path.basename(decodeURIComponent(filenameMatch[1].trim()))
}
core.debug(`Content-Type: ${contentType}, isZip: ${isZip}, skipDecompress: ${skipDecompress}`)