php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #67996 ZipArchive stores and extracts parent directories
Submitted: 2014-09-10 12:51 UTC Modified: 2014-09-12 08:59 UTC
From: petrhudecek2010 at gmail dot com Assigned:
Status: Not a bug Package: Zip Related
PHP Version: 5.5.16 OS: Windows 8.1
Private report: No CVE-ID: None
 [2014-09-10 12:51 UTC] petrhudecek2010 at gmail dot com
Description:
------------
You may use ZipArchive->addEmptyDir to add a folder in a parent directory without renaming it. You can then extract using ZipArchive and the folder will be recreated in the parent folders of the destination.

Test script:
---------------
<?php
$archive = new ZipArchive();
$archive->open('a.zip',ZipArchive::CREATE);
$archive->addEmptyDir("../../down");
$archive->close();

$archive2 = new ZipArchive();
$archive2->open('a.zip');
$archive2->extractTo('.');
$archive2->close();

Expected result:
----------------
During creation:
An error. The ZIP file should not be created.

During extraction:
It should silently succeed. The folder "down" should not be created.

Actual result:
--------------
The file "a.zip" was created. During extraction, the folder "down" was created in the grandfather directory.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-09-12 08:59 UTC] ab@php.net
-Status: Open +Status: Not a bug
 [2014-09-12 08:59 UTC] ab@php.net
That's what I read in http://www.pkware.com/documents/casestudies/APPNOTE.TXT chapter 4.4.17:

"4.4.17.1 The name of the file, with optional relative path.
       The path stored MUST not contain a drive or
       device letter, or a leading slash.  All slashes
       MUST be forward slashes '/' as opposed to
       backwards slashes '\' for compatibility with Amiga
       and UNIX file systems etc.  If input came from standard
       input, there is no file name field. "

Thus the current behavior is valid. You can use chdir() to achieve the result you've described.

Thanks.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Tue Jul 16 10:01:26 2019 UTC