starred/sharpcompress
1
0
Fork 0
mirror of https://github.com/adamhathcock/sharpcompress.git synced 2026-04-05 21:51:09 +00:00
Code Issues 975 Packages Projects Releases 25 Wiki Activity

Zip Slip Vulnerability Fix is not present in advertised nuget v 0.21.1 #308

New Issue
Closed
opened 2026-01-29 22:09:51 +00:00 by claunia · 1 comment
claunia commented 2026-01-29 22:09:51 +00:00
Owner
Copy Link

Originally created by @diaconesq on GitHub (Jun 28, 2018).

The Zip Slip vuln is fixed by #374 and should be included in v 0.21.0 as described here

However: I have decompiled versions 0.21.0 and 0.21.1 from Nuget.org (the .net 4.5 dll) and the fix is NOT there.

Decompiled Nuget code:
image

The PR for the fix:
image

Originally created by @diaconesq on GitHub (Jun 28, 2018). The Zip Slip vuln is fixed by #374 and should be included in v 0.21.0 as described [here](https://github.com/snyk/zip-slip-vulnerability) However: I have decompiled versions 0.21.0 and 0.21.1 from Nuget.org (the .net 4.5 dll) and the fix is NOT there. Decompiled Nuget code: ![image](https://user-images.githubusercontent.com/3482077/42028109-4af9f7aa-7ac3-11e8-98c1-eb96f64a6a3d.png) The PR for the fix: ![image](https://user-images.githubusercontent.com/3482077/42028306-cab37ae8-7ac3-11e8-986d-d09706c35448.png)
claunia commented 2026-01-29 22:09:52 +00:00
Author
Owner
Copy Link

@adamhathcock commented on GitHub (Jun 28, 2018):

You'll notice the classes you're referencing are two different classes.

The issue isn't that it's missing but incomplete. The implementation previously provided was for the Archive API and not the Reader API as you want. This should be fixed.

@adamhathcock commented on GitHub (Jun 28, 2018): You'll notice the classes you're referencing are two different classes. The issue isn't that it's missing but incomplete. The implementation previously provided was for the Archive API and not the Reader API as you want. This should be fixed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
duplicate
enhancement
feedback requested
not bug
pull-request
Mirrored from GitHub Pull Request
 question
up for grabs
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/sharpcompress#308
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?