Skip to content

Fix code scanning alert no. 1: Arbitrary file access during archive extraction ("Zip Slip") #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 30, 2024

Conversation

sayedpfe
Copy link
Owner

Fixes https://github.com/sayedpfe/TechExcel-Accelerate-developer-productivity-with-GitHub-Copilot-and-Dev-Box/security/code-scanning/1

To fix the problem, we need to ensure that the paths derived from the zip archive entries are validated to prevent directory traversal attacks. This involves:

  1. Using Path.GetFullPath to resolve any directory traversal elements in the combined path.
  2. Ensuring that the resolved path is within the intended destination directory.

The steps to implement the fix are:

  1. Combine the destination directory and the entry's full name using Path.Combine.
  2. Resolve the combined path using Path.GetFullPath.
  3. Resolve the destination directory path using Path.GetFullPath.
  4. Check if the resolved file path starts with the resolved destination directory path.
  5. If the check fails, throw an exception to prevent extraction.
  6. If the check passes, proceed with extracting the file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…xtraction ("Zip Slip")

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@sayedpfe sayedpfe marked this pull request as ready for review October 30, 2024 13:35
@sayedpfe sayedpfe merged commit e843d44 into main Oct 30, 2024
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant