Skip to content

Commit 67ce996

Browse files
Fix code scanning alert no. 2: Arbitrary file access during archive extraction ("Zip Slip")
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent d2769b0 commit 67ce996

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,12 +94,13 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
9494

9595
public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
9696
{
97-
string destFileName = Path.Combine(destDirectory, entry.FullName);
97+
string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
98+
string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
9899

99100
// Ensure the destination file is within the destination directory
100-
if (!Path.GetFullPath(destFileName).StartsWith(Path.GetFullPath(destDirectory), StringComparison.Ordinal))
101+
if (!destFileName.StartsWith(fullDestDirPath, StringComparison.Ordinal))
101102
{
102-
throw new InvalidOperationException("Entry is trying to write outside of the destination directory.");
103+
throw new InvalidOperationException("Entry is trying to write outside of the destination directory.");
103104
}
104105

105106
entry.ExtractToFile(destFileName);

0 commit comments

Comments
 (0)