Adm-zip extractAllTo and extractEntryTo path traversal

[ajxchapman]

The adm-zip.js:extractAllTo and adm-zip.js:extractEntryTo methods do not sanitize zip entry filenames allowing files to be extracted outside of the targetPath argument directory.

These functions use path.resolve to combine the targetPath argument with the zip entry entryName without checking or sanitizing the result. If a zip file contains a filename with an absolute path, e.g. /tmp/outfile, or a relative path with parent directory specifiers, e.g. ../outfile, these entries will be extracted outside the specified targetPath directory.

Both extractAllTo and extractEntryTo should check that the result of path.resolve is under the targetPath directory and discard or sanitise any paths that do not pass this check.

[ecneladis]

Already reported more than two years ago: #117

[manjeet13]

How come this hasn't been fixed yet?