Don't allow '/../' to be part of the path for delete file triggers.

1 files changed, 5 insertions, 1 deletions

diff --git a/android/sqlite3_android.cpp b/android/sqlite3_android.cpp
index 27334ef..3e11808 100644
--- a/android/sqlite3_android.cpp
+++ b/android/sqlite3_android.cpp
@@ -161,7 +161,11 @@ static void delete_file(sqlite3_context * context, int argc, sqlite3_value ** ar
         sqlite3_result_null(context);
         return;        
     }
-    
+    if (strstr(path, "/../") != NULL) {
+        sqlite3_result_null(context);
+        return;
+    }
+
     int err = unlink(path);
     if (err != -1) {
         // No error occured, return true