accessor: forbid slashes in file names

[pxar.git] / src / accessor / mod.rs

diff --git a/src/accessor/mod.rs b/src/accessor/mod.rs
index 72d7461531388ba56715a112b9753df498a15770..ca8bcc49aa3901dc0683110be8f9248141414e2a 100644 (file)
--- a/src/accessor/mod.rs
+++ b/src/accessor/mod.rs
@@ -626,6 +626,10 @@ impl<T: Clone + ReadAt> DirectoryImpl<T> {
             io_bail!("invalid empty file name");
         }
 
+        if path.contains(&b'/') {
+            io_bail!("illegal path found (contains slashes, this is a security concern)");
+        }
+
         let file_name = PathBuf::from(OsString::from_vec(path));
         format::check_file_name(&file_name)?;