Author serhiy.storchaka
Recipients amaury.forgeotdarc, gregory.p.smith, ned.deily, r.david.murray, schmir, serhiy.storchaka, twb
Date 2012-04-08.06:56:47
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
> +        # make sure the zip file isn't traversing out of the path
> +        if not targetpath.startswith(basepath):

Check is insufficient. basepath='/etc/asd', member.filename='../asdfgh'.

The issue10905 has relations with this issue.

P. S. Viewing patches in this issue is not working.
Date User Action Args
2012-04-08 06:56:48serhiy.storchakasetrecipients: + serhiy.storchaka, gregory.p.smith, amaury.forgeotdarc, schmir, ned.deily, r.david.murray, twb
2012-04-08 06:56:48serhiy.storchakasetmessageid: <>
2012-04-08 06:56:47serhiy.storchakalinkissue6972 messages
2012-04-08 06:56:47serhiy.storchakacreate