zip-archive 0.4 → 0.4.1

raw patch · 3 files changed

+23/−12 lines, 3 filesdep ~directory

Dependency ranges changed: directory

Files

• changelog +10/−0
• src/Codec/Archive/Zip.hs +12/−11
• zip-archive.cabal +1/−1

@@ -1,3 +1,13 @@+zip-archive 0.4.1++  * writEntry behavior change: Improve raising of UnsafePath error (#55).+    Previously we raised this error spuriously when archives were unpacked+    outside the working directory.  Now we raise it if eRelativePath contains+    ".." as a path component, or eRelativePath path is an absolute path and+    there is no separate destination directory.  (Note that `/foo/bar` is fine+    as a path as long as a destination directory, e.g. `/usr/local`, is+    specified.)+ zip-archive 0.4    * Implement read-only support for PKWARE encryption (Sergii Rudchenko).

@@ -77,15 +77,14 @@ import Data.Binary import Data.Binary.Get import Data.Binary.Put-import Data.List (nub, find, intercalate, isPrefixOf, isInfixOf)+import Data.List (nub, find, intercalate) import Data.Data (Data) import Data.Typeable (Typeable) import Text.Printf import System.FilePath import System.Directory        (doesDirectoryExist, getDirectoryContents,-        createDirectoryIfMissing, getModificationTime, getCurrentDirectory,-        makeAbsolute)+        createDirectoryIfMissing, getModificationTime) import Control.Monad ( when, unless, zipWithM_ ) import qualified Control.Exception as E import System.IO ( stderr, hPutStrLn )@@ -350,14 +349,16 @@ writeEntry opts entry = do   when (isEncryptedEntry entry) $     E.throwIO $ CannotWriteEncryptedEntry (eRelativePath entry)-  let path = case [d | OptDestination d <- opts] of-                  (x:_) -> x </> eRelativePath entry-                  _     -> eRelativePath entry-  absPath <- makeAbsolute path-  curDir <- getCurrentDirectory-  let isUnsafePath = ".." `isInfixOf` absPath ||-                     not (curDir `isPrefixOf` absPath)-  when isUnsafePath $ E.throwIO $ UnsafePath path+  let relpath = eRelativePath entry+  let isUnsafePath = ".." `elem` splitDirectories relpath+  when isUnsafePath $+    E.throwIO $ UnsafePath relpath+  path <- case [d | OptDestination d <- opts] of+             (x:_) -> return (x </> relpath)+             _ | isAbsolute relpath+                   -> E.throwIO $ UnsafePath relpath+               | otherwise+                   -> return relpath   -- create directories if needed   let dir = takeDirectory path   exists <- doesDirectoryExist dir

@@ -1,5 +1,5 @@ Name:                zip-archive-Version:             0.4+Version:             0.4.1 Cabal-Version:       2.0 Build-type:          Simple Synopsis:            Library for creating and modifying zip archives.