Fix extract path

Author: bostko

lib/doc2text/xml_based_document_file.rb

@@ -1,5 +1,4 @@
 require 'zip'
-require 'tmpdir'
 
 module Doc2Text
   module XmlBasedDocument
@@ -9,22 +8,13 @@ def initialize(document_path)
       end
 
       def unpack
-        destination_root = Pathname.new(extract_path).realpath
-
         Zip::File.open(@document_path) {
             |zip_file|
+          Dir.mkdir(extract_path)
           zip_file.each do |entry|
-            entry_path = Pathname.new(entry.name)
-
-            next if entry_path.absolute?
-            destination_path = destination_root.join(entry.name).cleanpath
-
-            unless destination_path.to_s.start_with?(destination_root.to_s + File::SEPARATOR)
-              raise "Unsafe zip entry: #{entry.name}"
-            end
-
-            FileUtils.mkdir_p(destination_path.dirname)
-            zip_file.extract entry, entry.name, destination_directory: extract_path
+            zipped_file_extract_path = File.join extract_path, File.dirname(entry.name)
+            FileUtils.mkdir_p zipped_file_extract_path
+            zip_file.extract entry, nil, destination_directory: extract_path
           end
         }
       end
@@ -51,7 +41,7 @@ def extract_extension
       end
 
       def extract_path
-        @extract_path ||= Dir.mktmpdir(".#{File.basename(@document_path)}_#{extract_extension}")
+        @extract_path ||= File.join File.dirname(@document_path), ".#{File.basename(@document_path)}_#{extract_extension}"
       end
     end
   end

spec/unpack_docx_spec.rb

@@ -8,7 +8,7 @@ def rspec_extract_docx
     entries = Dir.glob "#{@odt.extract_path}/**/*"
     mandatory_files = %w([Content_Types].xml).map { |entry|
       File.join @odt.extract_path, entry }
-    expect(mandatory_files.to_set).to be_subset(entries.to_set)
+    expect(entries.to_set.subset? mandatory_files.to_set)
 
     @odt.clean
   end

spec/unpack_odt_spec.rb

@@ -9,7 +9,7 @@ def rspec_extract_odt
     entries = Dir.glob "#{@odt.extract_path}/**/*"
     mandatory_files = %w(manifest.rdf content.xml settings.xml styles.xml META-INF META-INF/manifest.xml meta.xml mimetype).map { |entry|
       File.join @odt.extract_path, entry }
-    expect(mandatory_files.to_set).to be_subset(entries.to_set)
+    expect(entries.to_set.subset? mandatory_files.to_set)
 
     @odt.clean
   end