Merge pull request #1429 from SaschaSchwarze0/sascha-all-doubledot-in…

…-name

Allow a file or directory having a name with two subsequent dots while still preventing path traversal

pkg/bundle/bundle.go

@@ -240,7 +240,7 @@ func Unpack(in io.Reader, targetPath string) error {
 		}
 
 		var target = filepath.Join(targetPath, header.Name)
-		if strings.Contains(target, "..") {
+		if strings.Contains(target, "/../") {
 			return fmt.Errorf("targetPath validation failed, path contains unexpected special elements")
 		}