Backport writing outside extraction directory bugfix from pyinstxtractor

pyinstxtractor · Jun 8, 2023 · 480823e · 480823e
1 parent 04c3d59
commit 480823e
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pyinstxtractor-ng.py b/pyinstxtractor-ng.py
@@ -193,6 +193,11 @@ def parseTOC(self):
             )
 
             name = name.decode("utf-8").rstrip("\0")
+
+            # Prevent writing outside the extraction directory
+            if name.startswith("/"):
+                name = name.lstrip("/")
+
             if len(name) == 0:
                 name = str(uniquename())
                 print(