diff --git a/lib/unzip-stream.js b/lib/unzip-stream.js index 5608184..cd55bb0 100644 --- a/lib/unzip-stream.js +++ b/lib/unzip-stream.js @@ -288,7 +288,7 @@ UnzipStream.prototype._prepareOutStream = function (vars, entry) { var isDirectory = vars.uncompressedSize === 0 && /[\/\\]$/.test(entry.path); // protect against malicious zip files which want to extract to parent dirs - entry.path = entry.path.replace(/^([/\\]*[.]+[/\\]+)*[/\\]*/, ""); + entry.path = entry.path.replace(/(?<=^|[/\\]+)[.][.]+(?=[/\\]+|$)/g, "."); entry.type = isDirectory ? 'Directory' : 'File'; entry.isDirectory = isDirectory;