1 files changed, 5 insertions, 0 deletions

diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zip.go b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
index a065c07..b0e70ca 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
@@ -42,6 +42,11 @@ func (d *ZipDecompressor) Decompress(dst, src string, dir bool) error {
         for _, f := range zipR.File {
                 path := dst
                 if dir {
+                        // Disallow parent traversal
+                        if containsDotDot(f.Name) {
+                                return fmt.Errorf("entry contains '..': %s", f.Name)
+                        }
+
                         path = filepath.Join(path, f.Name)
                 }