starred/sharpcompress
1
0
Fork 0
mirror of https://github.com/adamhathcock/sharpcompress.git synced 2026-02-03 21:23:38 +00:00
Code Issues 975 Packages Projects Releases 20 Wiki Activity

[PR #374] [MERGED] fix: prevent extracting archived files outside of target path #990

New Issue
Open
opened 2026-01-29 22:18:30 +00:00 by claunia · 0 comments
claunia commented 2026-01-29 22:18:30 +00:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/adamhathcock/sharpcompress/pull/374
Author: @odinn1984
Created: 5/2/2018
Status: ✅ Merged
Merged: 5/2/2018
Merged by: @adamhathcock

Base: master ← Head: feat/fail_on_outside_target_files

📝 Commits (1)

  • 80ceb1c fix: prevent extracting archived files outside of target path

📊 Changes

3 files changed (+46 additions, -2 deletions)

View changed files

📝 src/SharpCompress/Archives/IArchiveEntryExtensions.cs (+19 -2)
📝 tests/SharpCompress.Test/Zip/ZipArchiveTests.cs (+27 -0)
➕ tests/TestArchives/Archives/Zip.Evil.zip (+0 -0)

📄 Description

This PR is meant to fix an arbitrary file write vulnerability, that can be
achieved using a specially crafted zip archive, that holds path traversal
filenames. When the filename gets concatenated to the target extraction
directory, the final path ends up outside of the target folder.

A sample malicious zip file named Zip.Evil.zip was used,
and when running the code below, resulted in the creation of C:/Temp/evil.txt
outside of the intended target directory.

There are various possible ways to avoid this issue, some include checking
for .. (dot dot) characters in the filename, but the best solution in our
opinion is to check if the final target filename, starts with the target
folder (after both are resolved to their absolute path).

Stay secure,
Snyk Team

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/adamhathcock/sharpcompress/pull/374 **Author:** [@odinn1984](https://github.com/odinn1984) **Created:** 5/2/2018 **Status:** ✅ Merged **Merged:** 5/2/2018 **Merged by:** [@adamhathcock](https://github.com/adamhathcock) **Base:** `master` ← **Head:** `feat/fail_on_outside_target_files` --- ### 📝 Commits (1) - [`80ceb1c`](https://github.com/adamhathcock/sharpcompress/commit/80ceb1c375fdb1b4ffba16528c99089e804ce61f) fix: prevent extracting archived files outside of target path ### 📊 Changes **3 files changed** (+46 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/SharpCompress/Archives/IArchiveEntryExtensions.cs` (+19 -2) 📝 `tests/SharpCompress.Test/Zip/ZipArchiveTests.cs` (+27 -0) ➕ `tests/TestArchives/Archives/Zip.Evil.zip` (+0 -0) </details> ### 📄 Description This PR is meant to fix an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive, that holds path traversal filenames. When the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. A sample malicious zip file named Zip.Evil.zip was used, and when running the code below, resulted in the creation of C:/Temp/evil.txt outside of the intended target directory. There are various possible ways to avoid this issue, some include checking for .. (dot dot) characters in the filename, but the best solution in our opinion is to check if the final target filename, starts with the target folder (after both are resolved to their absolute path). Stay secure, Snyk Team --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
claunia added the pull-request label 2026-01-29 22:18:30 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
duplicate
enhancement
feedback requested
not bug
pull-request
Mirrored from GitHub Pull Request
 question
up for grabs
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/sharpcompress#990
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?