From ad35b5b5f0cade53ad10de2db9f0d6b4cee944b9 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 14:38:32 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20potential=20Path=20Travers?= =?UTF-8?q?al=20(ZIP=20Slip)=20via=20unsanitized=20filename?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit modifies `docs/index.html` to sanitize user-provided file names before adding them to a generated ZIP file. By stripping directory path components (`/` and `\`), this prevents malicious file uploads (e.g., via a crafted File object representing a path like `../../../evil.jpg`) from attempting directory traversal during extraction, mitigating a ZIP Slip vulnerability. Co-authored-by: paul0728 <44644609+paul0728@users.noreply.github.com> --- docs/index.html | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/index.html b/docs/index.html index 9d406c0..6e5ef76 100644 --- a/docs/index.html +++ b/docs/index.html @@ -310,7 +310,9 @@

Online Converter

const formatEnum = MagickFormat[titleCaseFormat] || targetExt.toUpperCase(); image.write(formatEnum, (data) => { - let originalName = file.name.split('.').slice(0, -1).join('.'); + // Sanitize filename to prevent Path Traversal (ZIP Slip) + const sanitizedFileName = file.name.split(/[/\\]/).pop(); + let originalName = sanitizedFileName.split('.').slice(0, -1).join('.'); if (!originalName) originalName = "image"; // fallback if no extension const outFileName = `${originalName}.${targetExt}`;