diff --git a/Archive/Tar.php b/Archive/Tar.php index efa394a..68bdffe 100644 --- a/Archive/Tar.php +++ b/Archive/Tar.php @@ -1770,10 +1770,10 @@ private function _maliciousFilename($file) if (strpos($file, 'phar://') === 0) { return true; } - if (strpos($file, '/../') !== false) { + if (strpos($file, DIRECTORY_SEPARATOR . '..' . DIRECTORY_SEPARATOR) !== false) { return true; } - if (strpos($file, '../') === 0) { + if (strpos($file, '..' . DIRECTORY_SEPARATOR) === 0) { return true; } return false;