Nick Craig-Wood
e1b0c09040
Whether an archive entry name can escape the archive's namespace was left entirely to each archiver. Enforce it in the archive backend too. List only passes on direct children of the directory listed and NewObject only returns the object asked for, so a future archiver which forgets to validate names cannot expose a traversal to fs/sync and fs/operations.