Skip to content

Commit 5cb451b

Browse files
atorralbaatorralba
authored
Merge pull request github#13475 from atorralba/atorralba/many/zipslip-docs-update
C#/Go/Java/JS/Python/Ruby: Update the description and qhelp of the Zipslip query
2 parents 64e591a + 8f6d2ed commit 5cb451b

File tree

18 files changed

+78
-59
lines changed

18 files changed

+78
-59
lines changed

‎csharp/ql/src/Security Features/CWE-022/ZipSlip.qhelp

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,15 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>Extracting files from a malicious zip archive without validating that the destination file path
7-
is within the destination directory can cause files outside the destination directory to be
8-
overwritten, due to the possible presence of directory traversal elements (<code>..</code>) in
9-
archive paths.</p>
6+
<p>Extracting files from a malicious zip file, or similar type of archive,
7+
is at risk of directory traversal attacks if filenames from the archive are
8+
not properly validated.</p>
109

1110
<p>Zip archives contain archive entries representing each file in the archive. These entries
1211
include a file path for the entry, but these file paths are not restricted and may contain
1312
unexpected special elements such as the directory traversal element (<code>..</code>). If these
14-
file paths are used to determine an output file to write the contents of the archive item to, then
15-
the file may be written to an unexpected location. This can result in sensitive information being
13+
file paths are used to create a filesystem path, then a file operation may happen in an
14+
unexpected location. This can result in sensitive information being
1615
revealed or deleted, or an attacker being able to influence behavior by modifying unexpected
1716
files.</p>
1817

‎csharp/ql/src/Security Features/CWE-022/ZipSlip.ql

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
2-
* @name Arbitrary file write during zip extraction ("Zip Slip")
3-
* @description Extracting files from a malicious zip archive without validating that the
4-
* destination file path is within the destination directory can cause files outside
5-
* the destination directory to be overwritten.
2+
* @name Arbitrary file access during archive extraction ("Zip Slip")
3+
* @description Extracting files from a malicious ZIP file, or similar type of archive, without
4+
* validating that the destination file path is within the destination directory
5+
* can allow an attacker to unexpectedly gain access to resources.
66
* @kind path-problem
77
* @id cs/zipslip
88
* @problem.severity error

‎csharp/ql/src/change-notes/2023-06-16-zipslip-rename.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* The query "Arbitrary file write during zip extraction ("Zip Slip")" (`cs/zipslip`) has been renamed to "Arbitrary file access during archive extraction ("Zip Slip")."

‎go/ql/src/Security/CWE-022/ZipSlip.qhelp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@
55

66
<overview>
77
<p>
8-
Extracting files from a malicious zip archive without validating that the destination file path
9-
is within the destination directory can cause files outside the destination directory to be
10-
overwritten, due to the possible presence of directory traversal elements (<code>..</code>) in
8+
Extracting files from a malicious zip file, or similar type of archive,
9+
is at risk of directory traversal attacks if filenames from the archive are
10+
not properly validated.
1111
archive paths.
1212
</p>
1313

1414
<p>
1515
Zip archives contain archive entries representing each file in the archive. These entries
1616
include a file path for the entry, but these file paths are not restricted and may contain
1717
unexpected special elements such as the directory traversal element (<code>..</code>). If these
18-
file paths are used to determine which output file the contents of an archive item should be written to, then
19-
the file may be written to an unexpected location. This can result in sensitive information being
18+
file paths are used to create a filesystem path, then a file operation may happen in an
19+
unexpected location. This can result in sensitive information being
2020
revealed or deleted, or an attacker being able to influence behavior by modifying unexpected
2121
files.
2222
</p>

‎go/ql/src/Security/CWE-022/ZipSlip.ql

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
2-
* @name Arbitrary file write during zip extraction ("zip slip")
3-
* @description Extracting files from a malicious zip archive without validating that the
4-
* destination file path is within the destination directory can cause files outside
5-
* the destination directory to be overwritten.
2+
* @name Arbitrary file access during archive extraction ("Zip Slip")
3+
* @description Extracting files from a malicious ZIP file, or similar type of archive, without
4+
* validating that the destination file path is within the destination directory
5+
* can allow an attacker to unexpectedly gain access to resources.
66
* @kind path-problem
77
* @id go/zipslip
88
* @problem.severity error

‎go/ql/src/change-notes/2023-06-16-zipslip-rename.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* The query "Arbitrary file write during zip extraction ("zip slip")" (`go/zipslip`) has been renamed to "Arbitrary file access during archive extraction ("Zip Slip")."

‎java/ql/src/Security/CWE/CWE-022/ZipSlip.qhelp

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,15 @@
33
"qhelp.dtd">
44
<qhelp>
55
<overview>
6-
<p>Extracting files from a malicious zip archive (or another archive format)
7-
without validating that the destination file path
8-
is within the destination directory can cause files outside the destination directory to be
9-
overwritten, due to the possible presence of directory traversal elements (<code>..</code>) in
10-
archive paths.</p>
6+
<p>Extracting files from a malicious zip file, or similar type of archive,
7+
is at risk of directory traversal attacks if filenames from the archive are
8+
not properly validated.</p>
119

1210
<p>Zip archives contain archive entries representing each file in the archive. These entries
1311
include a file path for the entry, but these file paths are not restricted and may contain
1412
unexpected special elements such as the directory traversal element (<code>..</code>). If these
15-
file paths are used to determine an output file to write the contents of the archive item to, then
16-
the file may be written to an unexpected location. This can result in sensitive information being
13+
file paths are used to create a filesystem path, then a file operation may happen in an
14+
unexpected location. This can result in sensitive information being
1715
revealed or deleted, or an attacker being able to influence behavior by modifying unexpected
1816
files.</p>
1917

‎java/ql/src/Security/CWE/CWE-022/ZipSlip.ql

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
2-
* @name Arbitrary file write during archive extraction ("Zip Slip")
3-
* @description Extracting files from a malicious archive without validating that the
4-
* destination file path is within the destination directory can cause files outside
5-
* the destination directory to be overwritten.
2+
* @name Arbitrary file access during archive extraction ("Zip Slip")
3+
* @description Extracting files from a malicious ZIP file, or similar type of archive, without
4+
* validating that the destination file path is within the destination directory
5+
* can allow an attacker to unexpectedly gain access to resources.
66
* @kind path-problem
77
* @id java/zipslip
88
* @problem.severity error

‎java/ql/src/change-notes/2023-06-16-zipslip-rename.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* The query "Arbitrary file write during archive extraction ("Zip Slip")" (`java/zipslip`) has been renamed to "Arbitrary file access during archive extraction ("Zip Slip")."

‎javascript/ql/src/Security/CWE-022/ZipSlip.qhelp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44
<qhelp>
55

66
<overview>
7-
<p>Extracting files from a malicious zip archive without validating that the destination file path
8-
is within the destination directory can cause files outside the destination directory to be
9-
overwritten, due to the possible presence of directory traversal elements (<code>..</code>) in
7+
<p>Extracting files from a malicious zip file, or similar type of archive,
8+
is at risk of directory traversal attacks if filenames from the archive are
9+
not properly validated.
1010
archive paths.</p>
1111

1212
<p>Zip archives contain archive entries representing each file in the archive. These entries
1313
include a file path for the entry, but these file paths are not restricted and may contain
1414
unexpected special elements such as the directory traversal element (<code>..</code>). If these
15-
file paths are used to determine an output file to write the contents of the archive item to, then
16-
the file may be written to an unexpected location. This can result in sensitive information being
15+
file paths are used to create a filesystem path, then a file operation may happen in an
16+
unexpected location. This can result in sensitive information being
1717
revealed or deleted, or an attacker being able to influence behavior by modifying unexpected
1818
files.</p>
1919

0 commit comments

Comments
 (0)