Repository navigation
Minizip allows extraction outside root folder #433
Description
With a specially crafted ZIP file, Minizip (via mz_zip_reader_save_all()) will write into $CWD/..
Minizip 2.9.0 - https://github.com/nmoinvaz/minizip
---------------------------------------------------
-l t.zip
Packed Unpacked Ratio Method Attribs Date Time CRC-32 Name
------ -------- ----- ------ ------- ---- ---- ------ ----
17 17 100% Stored 81800080 11-04-06 11:33 c7f761e7 ././y/x/../../../../../../../tmp/zz
21 56 37% Defl:X 81800080 10-22-19 23:48 572b1c12 ././y/x/../../../../../../../tmp/zz
Extraction:
Minizip 2.9.0 - https://github.com/nmoinvaz/minizip
---------------------------------------------------
-x t.zip
Archive t.zip
Extracting ././y/x/../../../../../../../tmp/zz
The file ../tmp/zz exists. Overwrite ? [y]es, [n]o, [A]ll:
Note how e.g. UnZip 6.00 handles this situation:
$ unzip t.zip
Archive: t.zip
warning: skipped "../" path component(s) in ././y/x/../../../../../../../tmp/zz
extracting: y/x/tmp/zz
warning: skipped "../" path component(s) in ././y/x/../../../../../../../tmp/zz
replace y/x/tmp/zz? [y]es, [n]o, [A]ll, [N]one, [r]ename:
Activity
Coeur commentedon Oct 23, 2019
For reference, SSZipArchive (which uses minizip internally) shouldn't be affected by this issue, as I'm using native (Apple) path sanitation:
https://github.com/ZipArchive/ZipArchive/blob/63cc9b455c32cbbeb4df5017390e0f6a2af50c78/SSZipArchive/SSZipArchive.m#L1253-L1256
Fixed path not resolving properly when it begins with ..\ more than o…
nmoinvaz commentedon Oct 24, 2019
It is now fixed in
devbranch. Thanks. Ref #268.Fixed path not resolving properly when previous output buffer contain…
Fixed path not resolving properly when previous output buffer contain…
ASE: storage.cc: adjust old link to zlib-ng/minizip-ng/issues/433
Merge branch 'minizip-ng-submodule'
ASE: storage.cc: adjust old link to zlib-ng/minizip-ng/issues/433
Merge branch 'use-git-submodule'