防止Unzip文件恶意攻击

app/lea/Debug.go

@@ -6,8 +6,16 @@ import (
     "github.com/revel/revel"
 )
 
-func Log(i interface{}) {
+func Log(i ...interface{}) {
-	revel.INFO.Println(i)
+    revel.INFO.Println(i...)
+}
+
+func LogW(i ...interface{}) {
+    revel.WARN.Println(i...)
+}
+
+func Log1(key, i interface{}) {
+    revel.INFO.Println(key, i)
 }
 
 func LogJ(i interface{}) {

app/lea/archive/zip.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path"
 	"strings"
+	"github.com/leanote/leanote/app/lea"
 )
 
 // main functions shows how to TarGz a directory/file and
@@ -150,6 +151,12 @@ func Unzip(srcFilePath string, destDirPath string) (ok bool, msg string) {
 			panic(err)
 		}
 
+		// 包含恶意目录
+		if strings.Contains(f.Name, "../") {
+			lea.LogW("恶意文件", f.Name);
+			continue
+		}
+
 		// 把首文件夹去掉, 即j去掉, 分离出文件夹和文件名
 		paths := strings.Split(f.Name, "/")
 		prePath := ""