Blame SOURCES/okular-fix-path-traversal-issue-when-extracting-okular-file.patch

765eef
diff --git a/core/document.cpp b/core/document.cpp
765eef
index bc0232a..a2c8b46 100644
765eef
--- a/core/document.cpp
765eef
+++ b/core/document.cpp
765eef
@@ -3826,6 +3826,18 @@ bool Document::openDocumentArchive( const QString & docFile, const KUrl & url )
765eef
        return false;
765eef
 
765eef
     const KArchiveDirectory * mainDir = okularArchive.directory();
765eef
+
765eef
+    // Check the archive doesn't have folders, we don't create them when saving the archive
765eef
+    // and folders mean paths and paths mean path traversal issues
765eef
+    foreach ( const QString &entry, mainDir->entries() )
765eef
+    {
765eef
+        if ( mainDir->entry( entry )->isDirectory() )
765eef
+        {
765eef
+            kWarning(OkularDebug) << "Warning: Found a directory inside" << docFile << " - Okular does not create files like that so it is most probably forged.";
765eef
+            return false;
765eef
+        }
765eef
+    }
765eef
+
765eef
     const KArchiveEntry * mainEntry = mainDir->entry( "content.xml" );
765eef
     if ( !mainEntry || !mainEntry->isFile() )
765eef
         return false;