Disallow leading / in zip archives

This commit is contained in:
Sebastian Serth
2022-08-18 16:45:15 +02:00
parent 3248bd74d1
commit acc07ffa5d

View File

@ -27,7 +27,7 @@ class SubmissionsController < ApplicationController
stringio = Zip::OutputStream.write_buffer do |zio|
@files.each do |file|
zio.put_next_entry(file.filepath)
zio.put_next_entry(file.filepath.delete_prefix('/'))
zio.write(file.content.presence || file.native_file.read)
end