Merge branch 'tizen_4.0' into tizen_5.0

[platform/core/api/webapi-plugins.git] / src / archive / archive_instance.cc

diff --git a/src/archive/archive_instance.cc b/src/archive/archive_instance.cc
index cf7f9c8..91a0afc 100644 (file)
--- a/src/archive/archive_instance.cc
+++ b/src/archive/archive_instance.cc
@@ -534,6 +534,14 @@ void ArchiveInstance::Extract(const picojson::value& args, picojson::object& out
   picojson::value v_entry_name = data.at(PARAM_NAME);
 
   const double callbackId = args.get(JSON_CALLBACK_ID).get<double>();
+  const auto entry_path = v_entry_name.get<std::string>();
+  if (pathContainsProhibitedSubstrings(entry_path)) {
+    const std::string error_msg = "Entry path " + entry_path + " contains a prohibited substring";
+    LoggerE("%s", error_msg.c_str());
+    PostError(PlatformResult{ErrorCode::UNKNOWN_ERR, error_msg}, callbackId);
+    return;
+  }
+
   const long operationId = static_cast<long>(v_op_id.get<double>());
   const long handle = static_cast<long>(v_handle.get<double>());