#914 Fixed path traversal evasion on extraction of purposely-crafted PEA archive containing relative paths, vulnerability and poc reported by Harshit Gupta

[Giorgio Tani]

In PeaZip versions prior to 11.1.0 the canonicalization of paths in PEA archives was not properly enforced, even if format specifications required (and the implementation expected) the input being always absolute full qualified names.
This opened up the opportunity of conducing a path traversal evasion attack, crafting a PEA archive containing relative paths which could be pointed to be extracted to arbitrary destinations outside the expected extraction root path.

The vulnerability, and its relative poc, was reported by Harshit Gupta.

The fix implemented in 11.1.0 involves enforcing canonicalization of names in PEA archives, always resolving relative paths to absolute paths which are correctly handled in any stage of the management of the archive.
Moreover, as additional security layer, the PEA extraction routine now explicitly rejects archives containing relative paths stored in name fields, reporting the incident to the user and stopping the extraction of the archive.

Versions affected: any prior to 11.1.0
Vector: Purposely crafted PEA archives
Mechanism: Extract the crafted PEA archives
Effect: Path traversal evasion, allowing writing outside expected locations
Fix: Fixed in 11.1.0, update is recommended