mudhorn/oh-my-posh
1
0
Fork 0
mirror of https://github.com/JanDeDobbeleer/oh-my-posh.git synced 2025-01-29 12:01:07 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(font): prevent zipslip attacks

Browse source
This commit is contained in:
Jan De Dobbeleer 2024-07-14 20:41:10 +02:00 committed by Jan De Dobbeleer
parent 4aba8fa9db
commit 08c37417a2
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/font/install.go
View file

@ -35,6 +35,12 @@ func InstallZIP(data []byte, user bool) ([]string, error) {
fonts := make(map[string]*Font)
for _, zf := range zipReader.File {
// prevent zipslip attacks
// https://security.snyk.io/research/zip-slip-vulnerability
if strings.Contains(zf.Name, "..") {
continue
}
rc, err := zf.Open()
if err != nil {
return families, err