[wp-trac] [WordPress Trac] #42026: Regression in 4.8.2: WordPress now prevents certain unzipping valid filename patterns (but not creating them)

[WordPress Trac]

#42026: Regression in 4.8.2: WordPress now prevents certain unzipping valid
filename patterns (but not creating them)
---------------------------+------------------------------
 Reporter:  DavidAnderson  |       Owner:
     Type:  defect (bug)   |      Status:  new
 Priority:  normal         |   Milestone:  Awaiting Review
Component:  General        |     Version:  4.8.2
 Severity:  normal         |  Resolution:
 Keywords:                 |     Focuses:
---------------------------+------------------------------

Comment (by DavidAnderson):

 To follow up: when I say that the check is too crude, I mean that it's
 doing a lot more than just preventing directory traversal attacks. It
 should be checking for actual directory traversal, i.e. `../` or `..\`,
 not just two consecutive periods, which is something real-world users have
 been using as a legitimate filename element. (It's not a pretty filename
 convention, but that's not relevant).

--
Ticket URL: <https://core.trac.wordpress.org/ticket/42026#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform