update

Author: admpub

archive.go

@@ -78,9 +78,18 @@ func Zip(srcDirPath string, destFilePath string, args ...*regexp.Regexp) (n int6
 	return
 }
 
-func IllegalFilePath(path string) bool {
+func IllegalFilePath(fpath string) bool {
+	if fpath == `..` {
+		return true
+	}
+	if strings.HasSuffix(fpath, `..`) {
+		i := len(fpath) - 3
+		if fpath[i] == '/' || fpath[i] == '\\' {
+			return true
+		}
+	}
 	var dots int
-	for _, c := range path {
+	for _, c := range fpath {
 		switch c {
 		case '.':
 			dots++

archive_test.go

@@ -8,23 +8,29 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestZip(t *testing.T) {
-	MkdirAll(`testdata`, os.ModePerm)
-	n, err := Zip(`./encoding`, `testdata/test.zip`)
-	assert.NoError(t, err)
-	assert.NotEqual(t, n, 0)
-
-	err = Unzip(`testdata/test.zip`, `testdata/unarchive`)
-	assert.NoError(t, err)
-
+func TestIllegalFilePath(t *testing.T) {
 	assert.Equal(t, `/a/b/c`, filepath.Dir(`/a/b/c/..a.txt`))
 	assert.Equal(t, `/a/b`, filepath.Dir(`/a/b/c/../a.txt`))
 	assert.Equal(t, `/abc/a/b/a.txt`, filepath.Join(`/abc`, `/a/b/c/../a.txt`))
 	assert.Equal(t, `/abc/a\b\c\..\a.txt`, filepath.Join(`/abc`, `/a\b\c\..\a.txt`))
 	assert.Equal(t, `/abc/a/b/c/..a.txt`, filepath.Join(`/abc`, `/a/b/c/..a.txt`))
+	assert.Equal(t, `/a/b`, filepath.Join(`/a/b/c`, `..`))
+	assert.Equal(t, `/a/b`, filepath.Join(`/a/b/c/..`))
 	assert.True(t, IllegalFilePath(`a/b/c/../a.txt`))
 	assert.True(t, IllegalFilePath(`a/b/c/..\a.txt`))
 	assert.False(t, IllegalFilePath(`a/b/c/..a.txt`))
+	assert.True(t, IllegalFilePath(`..`))
+	assert.True(t, IllegalFilePath(`/..`))
+}
+
+func TestZip(t *testing.T) {
+	MkdirAll(`testdata`, os.ModePerm)
+	n, err := Zip(`./encoding`, `testdata/test.zip`)
+	assert.NoError(t, err)
+	assert.NotEqual(t, n, 0)
+
+	err = Unzip(`testdata/test.zip`, `testdata/unarchive`)
+	assert.NoError(t, err)
 }
 
 func TestTarGz(t *testing.T) {