Skip to content

Commit a0e46b8

Browse files
Fix code scanning alert no. 1: Arbitrary file access during archive extraction ("Zip Slip")
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent c505611 commit a0e46b8

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,11 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
9494

9595
public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
9696
{
97-
string destFileName = Path.Combine(destDirectory, entry.FullName);
97+
string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
98+
string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
99+
if (!destFileName.StartsWith(fullDestDirPath)) {
100+
throw new InvalidOperationException("Entry is outside the target dir: " + destFileName);
101+
}
98102
entry.ExtractToFile(destFileName);
99103
}
100104
}

0 commit comments

Comments
 (0)