diff options
Diffstat (limited to 'django/utils/archive.py')
| -rw-r--r-- | django/utils/archive.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/django/utils/archive.py b/django/utils/archive.py index 4042e89af9..e9c0ce7cb4 100644 --- a/django/utils/archive.py +++ b/django/utils/archive.py @@ -145,7 +145,11 @@ class BaseArchive: def target_filename(self, to_path, name): target_path = os.path.abspath(to_path) filename = os.path.abspath(os.path.join(target_path, name)) - if not filename.startswith(target_path): + try: + if os.path.commonpath([target_path, filename]) != target_path: + raise SuspiciousOperation("Archive contains invalid path: '%s'" % name) + except ValueError: + # Different drives on Windows raises ValueError. raise SuspiciousOperation("Archive contains invalid path: '%s'" % name) return filename |