Avoid using Dir.chdir

Author: fbacall

lib/ro_crate/model/directory.rb

@@ -74,9 +74,8 @@ def full_entry_path(relative_path)
     end
 
     def list_all_files(source_directory, include_hidden: false)
-      args = ['**/*']
-      args << ::File::FNM_DOTMATCH if include_hidden
-      Dir.chdir(source_directory) { Dir.glob(*args) }.reject do |path|
+      flags = include_hidden ? ::File::FNM_DOTMATCH : 0
+      Dir.glob('**/*', flags: flags, base: source_directory).reject do |path|
         path == '.' || path == '..' || path.end_with?('/.')
       end
     end

lib/ro_crate/reader.rb

@@ -1,7 +1,11 @@
+require 'zip/version'
+
 module ROCrate
   ##
   # A class to handle reading of RO-Crates from Zip files or directories.
   class Reader
+    LEGACY_EXTRACT = Zip::VERSION.start_with?('2.').freeze
+
     ##
     # Reads an RO-Crate from a directory or zip file.
     #
@@ -43,14 +47,20 @@ def self.unzip_to(source, target)
     # @param source [#read] An IO-like object containing a Zip file.
     # @param target [String, ::File, Pathname] The target directory where the file should be unzipped.
     def self.unzip_io_to(source, target)
-      Dir.chdir(target) do
-        Zip::InputStream.open(source) do |input|
-          while (entry = input.get_next_entry)
-            unless ::File.exist?(entry.name) || entry.name_is_directory?
-              FileUtils::mkdir_p(::File.dirname(entry.name))
-              ::File.binwrite(entry.name, input.read)
-            end
-          end
+      target = Pathname(target)
+      Zip::InputStream.open(source) do |input|
+        while (entry = input.get_next_entry)
+          next if entry.name_is_directory?
+
+          dest = target.join(entry.name)
+
+          # Guard against zip slip attacks, even though Rubyzip should block them.
+          raise "Unsafe path in zip entry: #{entry.name}" unless dest.to_s.start_with?(::File.realpath(target) + ::File::SEPARATOR)
+
+          next if dest.exist?
+
+          FileUtils.mkdir_p(dest.dirname)
+          ::File.binwrite(dest, input.read)
         end
       end
     end
@@ -61,14 +71,18 @@ def self.unzip_io_to(source, target)
     # @param source [String, ::File, Pathname] The location of the zip file.
     # @param target [String, ::File, Pathname] The target directory where the file should be unzipped.
     def self.unzip_file_to(source, target)
-      Dir.chdir(target) do
-        Zip::File.open(source) do |zipfile|
-          zipfile.each do |entry|
-            unless ::File.exist?(entry.name)
-              FileUtils::mkdir_p(::File.dirname(entry.name))
-              zipfile.extract(entry, entry.name)
-            end
-          end
+      target = Pathname(target)
+      Zip::File.open(source) do |zipfile|
+        zipfile.each do |entry|
+          dest = target.join(entry.name)
+
+          # Guard against zip slip attacks, even though Rubyzip should block them.
+          raise "Unsafe path in zip entry: #{entry.name}" unless dest.to_s.start_with?(::File.realpath(target) + ::File::SEPARATOR)
+
+          next if dest.exist?
+
+          FileUtils.mkdir_p(dest.dirname)
+          LEGACY_EXTRACT ? entry.extract(dest) : entry.extract(entry.name, destination_directory: target)
         end
       end
     end