Skip to content

Fix CodeQL bug about a zip slip#8110

Merged
rokonec merged 3 commits intodotnet:mainfrom
Forgind:fix-unzip
Nov 4, 2022
Merged

Fix CodeQL bug about a zip slip#8110
rokonec merged 3 commits intodotnet:mainfrom
Forgind:fix-unzip

Conversation

@Forgind
Copy link
Copy Markdown
Contributor

@Forgind Forgind commented Nov 1, 2022

Fixes AB#1645160

Context

We should check whether a zip archive is attempting to unzip into a parent directory, as that would be a security risk.

Changes Made

Fail if the user is attempting to unzip to a location the user has not given them permission to unzip to.

Testing

Notes


FileInfo destinationPath = new FileInfo(Path.Combine(destinationDirectory.FullName, zipArchiveEntry.FullName));
string fullDestinationPath = Path.GetFullPath(Path.Combine(destinationDirectory.FullName, zipArchiveEntry.FullName));
string fullDestinationDirectoryPath = Path.GetFullPath(destinationDirectory.FullName + Path.DirectorySeparatorChar);
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you pull this to outside the loop?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documentation seemed to want each ZipArchiveEntry checked individually, presumably because even if one entry is at a good path, the next could be at ..\..\..\..., so I don't think so.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fullDestinationDirectoryPath will be identical for each pass through the loop, so I'd rather compute it only once. fullDestinationPath will vary and must be computed for each file.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, yeah, good point. I can do that.

<data name="Unzip.DidNotUnzipBecauseOfFilter">
<value>Did not unzip file "{0}" because it didn't match the include filter or because it matched the exclude filter.</value>
</data>
<data name="Unzip.ZipSlipExploit">\
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<data name="Unzip.ZipSlipExploit">\
<data name="Unzip.ZipSlipExploit">

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤦‍♂️

@Forgind Forgind added the merge-when-branch-open PRs that are approved, except that there is a problem that means we are not merging stuff right now. label Nov 2, 2022
/// <param name="destinationDirectory">The <see cref="DirectoryInfo"/> to extract files to.</param>
private void Extract(ZipArchive sourceArchive, DirectoryInfo destinationDirectory)
{
string fullDestinationDirectoryPath = Path.GetFullPath(destinationDirectory.FullName + Path.DirectorySeparatorChar);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check that FullName doesn't already end in DirectorySeperatorChar, having two runs the risk of upsetting some file systems

@rokonec rokonec merged commit b6420ea into dotnet:main Nov 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-when-branch-open PRs that are approved, except that there is a problem that means we are not merging stuff right now.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants