sysy 022fbf633b fix: sanitize archive entry paths before extraction to prevent path traversal ...

Move path sanitization before directory handling in extractFile so
directory entries with "../" prefixes are rejected the same way file
entries already are. Add the same sanitization to extractSevenZipMultiPart
and both zip extraction loops in the Windows updater, which had no path
validation at all.

2026-09-16 23:31:35 -04:00

..

engine

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

testdata

test: enforce async extension API contract (#1452)

2026-08-27 12:51:37 +08:00

downloader_test.go

feat: new ui (#1455)

2026-09-05 19:53:41 +08:00

downloader.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

event.go

feat: extension support (#78)

2023-10-16 09:47:31 +08:00

extension_engine_session.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

extension_engine.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

extension_runtime_webview.go

feat: add FFmpeg WASM runtime (#1512)

2026-09-16 00:38:22 +08:00

extension_test.go

feat: add FFmpeg WASM runtime (#1512)

2026-09-16 00:38:22 +08:00

extension_unnamed_resource_test.go

feat: add FFmpeg WASM runtime (#1512)

2026-09-16 00:38:22 +08:00

extension_user_agent_test.go

feat: add FFmpeg WASM runtime (#1512)

2026-09-16 00:38:22 +08:00

extension_webview_config_test.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

extension_webview_config.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

extension_webview_remove_test.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

extension.go

feat(webview): add proxy support and per-extension profile lifecycle (#1517)

2026-09-16 23:17:43 +08:00

extract_7z.go

fix: sanitize archive entry paths before extraction to prevent path traversal

2026-09-16 23:31:35 -04:00

extract_queue_test.go

feat: queue extractions (#1227)

2026-01-05 15:53:19 +08:00

extract_queue.go

feat: queue extractions (#1227)

2026-01-05 15:53:19 +08:00

extract_rar.go

feat: multipart-archives (#1222)

2026-01-01 19:09:22 +08:00

extract_test.go

fix: gbk filename encoding in ZIP extraction (#1260)

2026-01-29 22:37:12 +08:00

extract_zip.go

fix: gbk filename encoding in ZIP extraction (#1260)

2026-01-29 22:37:12 +08:00

extract.go

fix: sanitize archive entry paths before extraction to prevent path traversal

2026-09-16 23:31:35 -04:00

hls_live_test.go

feat(hls): add native HLS (m3u8) download protocol (#1515)

2026-09-15 23:40:31 +08:00

hls_protocol_test.go

feat(hls): add native HLS (m3u8) download protocol (#1515)

2026-09-15 23:40:31 +08:00

model_test.go

feat: ed2k protocol support (#1316)

2026-03-17 19:42:16 +08:00

model.go

feat(hls): add native HLS (m3u8) download protocol (#1515)

2026-09-15 23:40:31 +08:00

script_test.go

feat: support post-task script hooks (#1265)

2026-02-08 18:40:06 +08:00

script_unix_test.go

feat: support post-task script hooks (#1265)

2026-02-08 18:40:06 +08:00

script_windows_test.go

feat: support post-task script hooks (#1265)

2026-02-08 18:40:06 +08:00

script.go

feat: support post-task script hooks (#1265)

2026-02-08 18:40:06 +08:00

storage.go

perf: slow down DHT announcing on errors (#1186)

2026-01-14 20:04:21 +08:00

webhook_test.go

refactor: fethcer interface & download flow (#1229)

2026-01-08 21:50:47 +08:00

webhook.go

feat: add download directory placeholders, category support (#1188)

2025-11-27 18:39:08 +08:00