in internal/platform/embed.go [125:182]
func unpackZip(archivePath string, destPath string) (error, bool) {
zipReader, err := zip.OpenReader(archivePath)
if err != nil {
return err, true
}
defer func(zipReader *zip.ReadCloser) {
err = zipReader.Close()
if err != nil {
log.Fatal(err)
}
}(zipReader)
for _, f := range zipReader.File {
fpath := filepath.Join(destPath, f.Name)
// Check for Path Traversal
if !strings.HasPrefix(fpath, filepath.Clean(destPath)+string(os.PathSeparator)) {
return fmt.Errorf("%s: illegal file path", fpath), true
}
if f.FileInfo().IsDir() {
err = os.MkdirAll(fpath, os.ModePerm)
if err != nil {
return err, true
}
continue
}
if err = os.MkdirAll(filepath.Dir(fpath), os.ModePerm); err != nil {
return err, true
}
dst, err := os.OpenFile(fpath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode())
if err != nil {
return err, true
}
src, err := f.Open()
if err != nil {
return err, true
}
_, err = io.Copy(dst, src)
if err != nil {
return err, true
}
err = dst.Close()
if err != nil {
return err, true
}
err = src.Close()
if err != nil {
return err, true
}
}
return nil, false
}