diff --git a/docs/index.html b/docs/index.html index 9d406c0..6e5ef76 100644 --- a/docs/index.html +++ b/docs/index.html @@ -310,7 +310,9 @@

Online Converter

const formatEnum = MagickFormat[titleCaseFormat] || targetExt.toUpperCase(); image.write(formatEnum, (data) => { - let originalName = file.name.split('.').slice(0, -1).join('.'); + // Sanitize filename to prevent Path Traversal (ZIP Slip) + const sanitizedFileName = file.name.split(/[/\\]/).pop(); + let originalName = sanitizedFileName.split('.').slice(0, -1).join('.'); if (!originalName) originalName = "image"; // fallback if no extension const outFileName = `${originalName}.${targetExt}`;