Skip to content

Commit 93d867c

Browse files
Fix code scanning alert no. 1: Arbitrary file access during archive extraction ("Zip Slip")
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent ad0b330 commit 93d867c

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

src/Application/src/RazorPagesTestSample/Pages/Index.cshtml.cs

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,12 @@ public async Task<IActionResult> OnPostAnalyzeMessagesAsync()
9494

9595
public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory)
9696
{
97-
string destFileName = Path.Combine(destDirectory, entry.FullName);
97+
string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
98+
string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
99+
if (!destFileName.StartsWith(fullDestDirPath))
100+
{
101+
throw new InvalidOperationException("Entry is outside the target dir: " + destFileName);
102+
}
98103
entry.ExtractToFile(destFileName);
99104
}
100105
}

0 commit comments

Comments
 (0)