Any way to override path traversal protection in unzip?

Question

When you try to unzip a file with relative paths above the working directory (e.g. ../../foo), you get this message:

warning: skipped "../" path component(s) in ../../foo

inflating: foo

The issue is, our software is creating these zips with relative paths during an installation, and if the installation goes wrong, we unzip them to put everything back the way it was. If the user has elected to store some data files "above" the normal installation directory, we end up with ../datafile in the backup. This should be perfectly fine, and we want unzip to trust the archive and put the files back if we ask. Unfortunately, I can't find an option to tell unzip to not worry about the ../ path components and unzip the archive exactly as it was created. Is there an option to unzip to do this?

Note that changing the way the zips are created is not possible at this time, so "Don't do it that way" is not an acceptable answer. We've got to play the hand we've been given. The target platform is RHEL 5.

Answer 1

This should do what you're asking for

unzip -: foo.zip

From the man page

-: [all but Acorn, VM/CMS, MVS, Tandem] allows to extract archive members into locations outside of the current '' extraction root folder''. For security reasons, unzip normally removes ''parent dir'' path components (''../'') from the names of extracted file. This safety feature (new for version 5.50) prevents unzip from accidentally writing files to ''sensitive'' areas outside the active extraction folder tree head. The -: option lets unzip switch back to its previous, more liberal behaviour, to allow exact extraction of (older) archives that used ''../'' components to create multiple directory trees at the level of the current extraction folder. This option does not enable writing explicitly to the root directory (''/''). To achieve this, it is necessary to set the extraction target folder to root (e.g. -d / ). However, when the -: option is specified, it is still possible to implicitly write to the root directory by specifiying enough ''../'' path components within the zip archive. Use this option with extreme caution.