Hmm, simply removing the check for ':' is likely to break things on Windows (consider 'C:/foo').

@cmb69 thank you for notification

ready for review @cmb69

@KonstantinKuklin, please remove the changes to NEWS. This should be added by the person who merges the PR. Otherwise there will be merge conflicts al the time. :)

@remicollet , what do you think about the patch?

@remicollet bump :)

@cmb69 are you happy with this ?

ZipArchive::extractTo() is not supposed to extract any files outside the given $destination. The existing code ensures that by assuming that any ./ and :/ can be special (relative paths; drive spec on Windows), and simply chopping the leading chars off. The patch would make this check much stricter, so there might be some chance/trick to bypass the check.

A particular issue appears the special treatment for Windows. This could result in different extraction paths depending on the OS, what might generally be undesirable, and could cause BC issues.

So I'm uneasy to apply this to stable branches.

That sounds like rejection of the idea behind the pull request to me, so I'm happy to close this here.

Thanks for input everyone ...