This commit is contained in:
Kovid Goyal
2021-08-22 13:13:13 +05:30
parent 42dcecde14
commit b282464604

View File

@@ -117,7 +117,7 @@ class ZlibDecompressor:
def resolve_name(name: str, base: str) -> Optional[str]:
if name.startswith('/'):
if name.startswith('/') or os.path.isabs(name):
return None
base = os.path.abspath(base)
q = os.path.abspath(os.path.join(base, name))