diff --git a/Archive/Tar.php b/Archive/Tar.php index 8a2d2db..f15df92 100644 --- a/Archive/Tar.php +++ b/Archive/Tar.php @@ -2124,7 +2124,16 @@ public function _extractList( } } } elseif ($v_header['typeflag'] == "2") { - if (strpos(realpath(dirname($v_header['link'])), realpath($p_path)) !== 0) { + $up = 0; + $down = 0; + foreach (explode("/", $v_header['link']) as $dir){ + if ($dir === "..") { + $up++; + } elseif ($dir !== "" && $dir !== ".") { + $down++; + } + } + if (str_starts_with($v_header['link'], "/") or $up > $down) { $this->_error( 'Out-of-path file extraction {' . $v_header['filename'] . ' --> ' .