micafer opened a new pull request, #2206: URL: https://github.com/apache/libcloud/pull/2206
## Fix path traversal when downloading objects to a directory ### Description Fix path traversal when downloading objects to a directory When download_object saves an object to a directory, it now uses only the object’s basename as the local filename. This prevents provider-supplied object names containing path traversal components from writing files outside the intended destination directory. Adds a regression test covering an object name with ../ components. ### Status - done, ready for review ### Checklist (tick everything that applies) - [x] [Code linting](http://libcloud.readthedocs.org/en/latest/development.html#code-style-guide) (required, can be done after the PR checks) - [ ] Documentation - [x] [Tests](http://libcloud.readthedocs.org/en/latest/testing.html) - [x] [ICLA](http://libcloud.readthedocs.org/en/latest/development.html#contributing-bigger-changes) (required for bigger changes) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
