Bug #67996 [NEW]: ZipArchive stores and extracts parent directories

From: petrhudecek2010 at gmail dot com Operating system: Windows 8.1 PHP version: 5.5.16 Package: Zip Related Bug Type: Bug Bug description:ZipArchive stores and extracts parent directories Description: ------------ You may use ZipArchive->addEmptyDir to add a folder in a parent directory without renaming it. You can then extract using ZipArchive and the folder will be recreated in the parent folders of the destination. Test script: --------------- <?php $archive = new ZipArchive(); $archive->open('a.zip',ZipArchive::CREATE); $archive->addEmptyDir("../../down"); $archive->close(); $archive2 = new ZipArchive(); $archive2->open('a.zip'); $archive2->extractTo('.'); $archive2->close(); Expected result: ---------------- During creation: An error. The ZIP file should not be created. During extraction: It should silently succeed. The folder "down" should not be created. Actual result: -------------- The file "a.zip" was created. During extraction, the folder "down" was created in the grandfather directory. -- Edit bug report at https://bugs.php.net/bug.php?id=67996&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=67996&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=67996&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=67996&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=67996&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=67996&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=67996&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=67996&r=needscript Try newer version: https://bugs.php.net/fix.php?id=67996&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=67996&r=support Expected behavior: https://bugs.php.net/fix.php?id=67996&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=67996&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=67996&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=67996&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=67996&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=67996&r=dst IIS Stability: https://bugs.php.net/fix.php?id=67996&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=67996&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=67996&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=67996&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=67996&r=mysqlcfg