Fix #438 (#439)

gesistsa · Jul 11, 2024 · 119e31d · 119e31d
1 parent 984529b
commit 119e31d
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/R/compression.R b/R/compression.R
@@ -46,7 +46,7 @@ compress_out <- function(cfile, filename, type = c("zip", "tar", "tar.gz", "tar.
     on.exit(unlink(tmp, recursive = TRUE), add = TRUE)
     file.copy(from = filename, to = file.path(tmp, basename(filename)), overwrite = TRUE)
     wd <- getwd()
-    on.exit(setwd(wd), add = TRUE)
+    on.exit(setwd(wd), add = TRUE) ## for security, see #438 and #319
     setwd(tmp)
     if (type == "zip") {
         o <- utils::zip(cfile2, files = basename(filename))
@@ -60,6 +60,7 @@ compress_out <- function(cfile, filename, type = c("zip", "tar", "tar.gz", "tar.
     if (type == "tar.bz2") {
         o <- utils::tar(cfile2, files = basename(filename), compression = "bzip2")
     }
+    setwd(wd) ## see #438
     if (o != 0) {
         stop(sprintf("File compression failed for %s!", cfile))
     }

diff --git a/tests/testthat/test_compress.R b/tests/testthat/test_compress.R
@@ -124,3 +124,16 @@ test_that("Wild zip and tar ref $425", {
         })
     }
 })
+
+test_that("Relative path #438", {
+    ## see test_export_list.R
+    withr::with_tempdir({
+        mylist <- list(
+            mtcars3 = mtcars[1:10, ],
+            mtcars2 = mtcars[11:20, ],
+            mtcars1 = mtcars[21:32, ]
+        )
+        rio::export_list(mylist, file = paste0("file_", 1:3, ".csv"), archive = "arch/archive.zip")
+        expect_true(file.exists("arch/archive.zip"))
+    })
+})