From 55969b8e549a99d5fc1bbfee03ba61773897a8ad Mon Sep 17 00:00:00 2001
From: ed <s@ocv.me>
Date: Sun, 6 Sep 2026 21:07:39 +0000
Subject: [PATCH] dk: block subdir zip (GHSA-mc69-pxc8-4xf4)

---
 copyparty/httpcli.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index bbbe2e878..3f72c3764 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -3151,7 +3151,8 @@ class HttpCli(object):
 
         v = self.uparam[k]
 
-        if self._use_dirkey(self.vn, ""):
+        is_dk = self._use_dirkey(self.vn, "")
+        if is_dk:
             vn = self.vn
             rem = self.rem
         else:
@@ -3163,6 +3164,9 @@ class HttpCli(object):
 
         items = zs.replace("\r", "").split("\n")
         items = [unquotep(x) for x in items if items]
+        if is_dk:
+            zss = set(vn_ls_regfile(self.args, vn, rem))
+            items = [x for x in items if x in zss]
 
         self.parser.drop()
         return self.tx_zip(k, v, "", vn, rem, items)