luciano/markitdown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Run pre-commit

Browse source
This commit is contained in:
gagb 2024-12-18 11:46:39 -08:00
parent 6e4caac70d
commit 5fc70864f2
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/markitdown/_markitdown.py
View file

@ -1144,9 +1144,14 @@ class ZipConverter(DocumentConverter):
# Safeguard against path traversal
for member in zipObj.namelist():
member_path = os.path.normpath(os.path.join(extraction_dir, member))
if not os.path.commonprefix([extraction_dir, member_path]) == extraction_dir:
raise ValueError(f"Path traversal detected in zip file: {member}")
if (
not os.path.commonprefix([extraction_dir, member_path])
== extraction_dir
):
raise ValueError(
f"Path traversal detected in zip file: {member}"
)
# Extract all files safely
zipObj.extractall(path=extraction_dir)