Aws-sdk-php: Transfer with relative path as destination folder

[Ydalb]

Confirm by changing [ ] to [x] below to ensure that it's a bug:

• [x] I've gone though Developer Guide and API reference
• [x] I've checked AWS Forums and StackOverflow for answers
• [x] I've searched for previous similar issues and didn't find any solution

Describe the bug

If you use .. in your destination folder, it fails downloading.

Version of AWS SDK for PHP?
v3.145.2

Version of PHP (php -v)?

PHP 7.4.7 (cli) (built: Jun 12 2020 00:04:10) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.7, Copyright (c), by Zend Technologies

To Reproduce (observed behavior)
Update the TransferTest::testDownloadsObjects() method, around line 182

// Replace
$dir = sys_get_temp_dir() . '/unittest';
`rm -rf $dir`;
mkdir($dir);
// with
$dir = sys_get_temp_dir() . '/unittest/../unittest';
`rm -rf $dir`;
mkdir($dir, 0777, true);

Launch phpunit test

./vendor/bin/phpunit ./tests/S3/TransferTest.php --filter testDownloadsObjects

Expected behavior
The test should pass

Screenshots

Additional context

The part of the code that fail is located in the Transfer::createDownloadPromise() method, only the $resolveSink is resolved, why not the $this->destination['path'] too ?

    private function createDownloadPromise()
    {
        //...
            if (strpos(
                    $this->resolveUri($resolveSink),
                    $this->destination['path']
                ) !== 0
            ) {
                throw new AwsException(
                    'Cannot download key ' . $objectKey
                    . ', its relative path resolves outside the'
                    . ' parent directory ' . $this->resolveUri($resolveSink) . ' :: ' . $this->destination['path'], $command);
            }
        //...
    }

[diehlaws]

Thanks for reaching out to us about this @Ydalb. I'm looking into the intent behind the PR #1281 that introduced this logic to determine whether your proposed change is viable to add. In the meantime, it's possible to circumvent this behavior by setting your destination to the realpath corresponding to the destination path containing .. (e.g. $destination = realpath('../path/to/destination');). Once I have additional information on this I'll update the issue accordingly.