The unarj v2.43 archiver we have for use with clamav virus scanning does not really work. The same is true for the newer 2.65 version released by the author. The problem is unarj is unable to extract with paths, hence it will overwrite files and stuff won't actually be scanned.
At the moment, I've got a working port of 2.65 patched to extract with full paths. The last problem to solve is preventing path traversal exploits. I suspect that just searching for double dot ".." in the to be created path string is not enough but since I've never done this sort of thing, I'm not sure where/what to ask. I would like to find a standardized, well tested way to test strings for potential path traversal sequences. Searching with google has been fruitless. If you'd be so kind as to drop kick me in the right direction, possibly example code, it would be much appreciated. Kind Regards, JCR
