fix: prevent zip slip attacks in DXT unpack function #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

felixrieseberg merged 3 commits into modelcontextprotocol:main from ddworken:dworken/zipslip

Jul 18, 2025

Merged

fix: prevent zip slip attacks in DXT unpack function #74

Merge branch 'main' into dworken/zipslip

Annotations

10 warnings

test/cli.test.ts#L224

Replace ``node·${cliPath}·unpack·${execPackedFilePath}·${execUnpackedDir}`,` with `⏎··········`node·${cliPath}·unpack·${execPackedFilePath}·${execUnpackedDir}`,⏎·········`

test/cli.test.ts#L210

Replace `executableScript,·"#!/bin/bash\necho·'Hello·from·executable'"` with `⏎··········executableScript,⏎··········"#!/bin/bash\necho·'Hello·from·executable'",⏎········`

test/cli.test.ts#L207

Delete `········`

src/cli/unpack.ts#L71

Delete `············`

src/cli/unpack.ts#L65

Insert `);⏎`

src/cli/unpack.ts#L64

Replace `'utf8',·offset·+·46,·offset·+·46·+·filenameLength);` with `⏎··············"utf8",⏎··············offset·+·46,⏎··············offset·+·46·+·filenameLength,`

src/cli/unpack.ts#L59

Delete `········`

src/cli/unpack.ts#L57

Delete `········`

src/cli/unpack.ts#L44

Delete `······`

src/cli/unpack.ts#L2

Replace `·chmodSync,·existsSync,·mkdirSync,·readFileSync,·writeFileSync·` with `⏎··chmodSync,⏎··existsSync,⏎··mkdirSync,⏎··readFileSync,⏎··writeFileSync,⏎`

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: prevent zip slip attacks in DXT unpack function #74

Uh oh!

Uh oh!

fix: prevent zip slip attacks in DXT unpack function #74

Uh oh!

Annotations

The logs for this run have expired and are no longer available.

Re-running jobs...