Kimirock/freescout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not allow unsafe symlinks when UnZipping - GHSA-rw7g-qq32-c669

Browse Source
This commit is contained in:
FreeScout
2026-08-26 02:51:43 -07:00
parent 06e0e85dcc
commit 4e8e4d80c7
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
overrides/chumper/zipper/src/Chumper/Zipper/Zipper.php
View File

@@ -618,6 +618,7 @@ class Zipper
$realBase = realpath($path);
$realDest = realpath(pathinfo($path . DIRECTORY_SEPARATOR . $tmpPath)['dirname'] ?? '');
// On some systems $realDest is empty for valid paths.
// if ($realDest === false || strpos($realDest, $realBase) !== 0) {
if ($realBase && $realDest && strpos($realDest, $realBase) !== 0) {
\Log::error('[Zipper] Path traversal detected - path: '.$path.'; fileName: '.$fileName.'; realBase: '.$realBase.'; tmpPath: '.$tmpPath.'; realDest: '.$realDest);
throw new \RuntimeException('Zipper: Path traversal detected');
@@ -632,5 +633,13 @@ class Zipper
$toPath = $path.DIRECTORY_SEPARATOR.$tmpPath;
$fileStream = $this->getRepository()->getFileStream($fileName);
$this->getFileHandler()->put($toPath, $fileStream);
// Unsafe symlink.
// https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-rw7g-qq32-c669
if (is_link($toPath) && ($link_target = readlink($toPath)) && !\Str::startsWith($link_target, $path)) {
$msg = '[Zipper] Unsafe symlink detected - symlink '.$tmpPath.' points to the file/folder outside of the destination path: '.$link_target;
\Log::error($msg);
throw new \RuntimeException($msg);
}
}
}