[flutter_tools] Reject archive entries that escape into a sibling directory by name prefix (#185794) by NadeemIqbal · Pull Request #186647 · flutter/flutter

NadeemIqbal · 2026-05-17T14:06:52Z

_WindowsUtils._unpackArchive in packages/flutter_tools/lib/src/base/os.dart validates that each archive entry resolves inside the target directory before writing it. The existing check compared the canonical destination path to the canonical target path with startsWith, which is vulnerable to prefix confusion: a target of bin\cache\artifacts\engine\windows-x64 and a canonical destination of bin\cache\artifacts\engine\windows-x64-profile\poc_marker.txt (as produced by a crafted entry like ..\windows-x64-profile\poc_marker.txt) returns true because the destination path starts with the target path as a string, even though it is a sibling directory.

Replaced the startsWith check with path.isWithin, which compares full path components, and hoisted the targetDirectoryCanonicalPath calculation out of the per-entry loop. Added a regression test covering the prefix-confusion case in packages/flutter_tools/test/general.shard/base/os_test.dart; existing ..\..\ test continues to pass.

Fixes #185794.

Pre-launch Checklist

…ectory by name prefix _WindowsUtils._unpackArchive validated archive entries against the target extraction directory using String.startsWith on canonical paths. The check is vulnerable to path prefix confusion: a destination like `<target>-sibling/x.txt` starts with the canonical target path (e.g. `<cache>/windows-x64-profile/x.txt` starts with `<cache>/windows-x64`) yet escapes the target dir, allowing a crafted artifact archive served via FLUTTER_STORAGE_BASE_URL to write into sibling engine cache directories. Replace the prefix check with `path.isWithin`, which compares full path components and correctly rejects sibling directories sharing a name prefix. Add a regression test that reproduces the prefix-confusion case from the linked report and asserts the sibling file is not written. Fixes flutter#185794.

gemini-code-assist

Code Review

This pull request replaces startsWith with path.isWithin in the Windows unzip utility to prevent path prefix confusion vulnerabilities and adds a corresponding regression test. Review feedback recommends hoisting the target directory's canonical path calculation outside the extraction loop for performance and updating the validation logic to explicitly allow entries identical to the target directory to avoid regressions.

gemini-code-assist · 2026-05-17T14:08:26Z

      final String targetDirectoryCanonicalPath = _fileSystem.path.canonicalize(
        targetDirectory.path,
      );


The targetDirectoryCanonicalPath is calculated for every entry in the archive. Since the targetDirectory does not change during the extraction process, this calculation should be hoisted outside of the loop for better performance, especially when dealing with archives containing many files.

gemini-code-assist · 2026-05-17T14:08:26Z

        targetDirectory.path,
      );
-      if (!destinationFileCanonicalPath.startsWith(targetDirectoryCanonicalPath)) {
+      if (!_fileSystem.path.isWithin(targetDirectoryCanonicalPath, destinationFileCanonicalPath)) {


The path.isWithin function returns false if the two paths are identical. If an archive contains an entry that resolves exactly to the target directory (e.g., an entry named . or an empty string), this check will now throw a StateError. This is a change in behavior from the previous startsWith implementation which allowed the root directory. To avoid potential regressions with archives that include the root directory as an entry, consider allowing the case where the destination path is equal to the target directory path.

Suggested change

if (!_fileSystem.path.isWithin(targetDirectoryCanonicalPath, destinationFileCanonicalPath)) {

if (!_fileSystem.path.isWithin(targetDirectoryCanonicalPath, destinationFileCanonicalPath) &&

!_fileSystem.path.equals(targetDirectoryCanonicalPath, destinationFileCanonicalPath)) {

Address review feedback (flutter#186647): the target directory does not change across archive entries, so canonicalize it once before iterating instead of per file.

bkonyi

This mostly LGTM, just a couple of comments.

bkonyi · 2026-05-19T18:56:05Z

      // Validate that the destFile is within the targetDirectory we want to
      // extract to.
      //
+      // The previous string `startsWith` check was vulnerable to path prefix


I don't think this comment is necessary.

bkonyi · 2026-05-19T18:56:54Z

        targetDirectory.path,
      );
-      if (!destinationFileCanonicalPath.startsWith(targetDirectoryCanonicalPath)) {
+      if (!_fileSystem.path.isWithin(targetDirectoryCanonicalPath, destinationFileCanonicalPath)) {


@bkonyi

- Drop the `startsWith`-vs-`isWithin` background comment per @bkonyi. - Allow archive entries that resolve exactly to the target directory (e.g. a file entry with an empty or `.` name) by accepting equality in addition to `isWithin`, restoring the pre-fix `startsWith` behavior for that edge case.

auto-submit · 2026-05-26T16:17:59Z

autosubmit label was removed for flutter/flutter/186647, because The base commit of the PR is older than 7 days and can not be merged. Please merge the latest changes from the main into this branch and resubmit the PR.

auto-submit · 2026-05-26T20:01:05Z

autosubmit label was removed for flutter/flutter/186647, because - The status or check suite Windows tool_integration_tests_2_10 has failed. Please fix the issues identified (or deflake) before re-applying this label.

flutter/flutter@54e199a...701665b 2026-06-02 engine-flutter-autoroll@skia.org Roll Skia from c97e939eb5c9 to 279b17fe9fc1 (16 revisions) (flutter/flutter#187425) 2026-06-02 bdero@google.com [Flutter GPU] Add block-compressed texture format support (BC, ETC2, ASTC LDR) (flutter/flutter#187281) 2026-06-02 bdero@google.com [Impeller] Allow attaching specific texture mip levels and slices (flutter/flutter#187066) 2026-06-02 bdero@google.com [Impeller] Fix GLES command submission status before context is current (flutter/flutter#187293) 2026-06-02 engine-flutter-autoroll@skia.org Roll Dart SDK from 3cdc25e8ffe9 to d39850bf4a01 (9 revisions) (flutter/flutter#187409) 2026-06-01 jason-simmons@users.noreply.github.com [Impeller] Use glVertexAttribDivisor on GLES3 and glVertexAttribDivisorEXT on GLES2 with the extension (flutter/flutter#187313) 2026-06-01 matt.boetger@gmail.com [Android] Add Javadoc documentation to TextInputChannel (flutter/flutter#186018) 2026-06-01 mvincentong@gmail.com Read FLTEnableWideGamut from Dart bundle (flutter/flutter#186509) 2026-06-01 matt.boetger@gmail.com [flutter_tools] Remove obsolete AndroidX console warning during Gradle builds (flutter/flutter#186077) 2026-06-01 kjlubick@users.noreply.github.com [skia] Update gni file list name hsw -> ml3 (flutter/flutter#184892) 2026-06-01 zhongliu88889@gmail.com [web] Always sync slider input attrs regardless of gesture mode (flutter/flutter#187217) 2026-06-01 zhongliu88889@gmail.com [flutter_driver] Don't throw when stderr is unavailable on web (flutter/flutter#187190) 2026-06-01 116356835+AbdeMohlbi@users.noreply.github.com Remove unused code in `FlutterPluginUtils.kt` (flutter/flutter#187012) 2026-06-01 taak140@gmail.com [flutter_tools] Fix `flutter drive --chrome-binary` being ignored on web (flutter/flutter#185481) 2026-06-01 davidmartos96@gmail.com Eager failure when building and no XCode build settings (flutter/flutter#184726) 2026-06-01 goung123@gmail.com Fix Windows Korean IME caret position during composition (flutter/flutter#186353) 2026-06-01 okorohelijah@google.com iOS: update provisioning profile for 2026-2027 cert (flutter/flutter#187280) 2026-06-01 154381524+flutteractionsbot@users.noreply.github.com Sync CHANGELOG.md from stable (flutter/flutter#187380) 2026-06-01 jason-simmons@users.noreply.github.com Reland "Move dart-lang/ai to a top level third party dependency in engine (#187268)" (flutter/flutter#187378) 2026-06-01 stuartmorgan@google.com Add vector_math to Framework triage (flutter/flutter#187389) 2026-06-01 engine-flutter-autoroll@skia.org Roll Packages from e930ced to f5d50ca (4 revisions) (flutter/flutter#187381) 2026-06-01 mr_nadeem_iqbal@yahoo.com [flutter_tools] Reject archive entries that escape into a sibling directory by name prefix (#185794) (flutter/flutter#186647) 2026-06-01 bkonyi@google.com [flutter_tools] Fix widget_preview unawaited async write race condition (flutter/flutter#187177) 2026-06-01 137456488+flutter-pub-roller-bot@users.noreply.github.com Roll pub packages (flutter/flutter#187375) 2026-06-01 engine-flutter-autoroll@skia.org Roll Skia from 0aee4675e0ad to c97e939eb5c9 (7 revisions) (flutter/flutter#187371) 2026-06-01 mr_nadeem_iqbal@yahoo.com docs: Stack.clipBehavior = Clip.none does not extend hit testing (#160787) (flutter/flutter#186643) If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/flutter-packages Please CC stuartmorgan@google.com,tarrinneal@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Packages: https://github.com/flutter/flutter/issues/new/choose To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md

…r#11822) flutter/flutter@54e199a...701665b 2026-06-02 engine-flutter-autoroll@skia.org Roll Skia from c97e939eb5c9 to 279b17fe9fc1 (16 revisions) (flutter/flutter#187425) 2026-06-02 bdero@google.com [Flutter GPU] Add block-compressed texture format support (BC, ETC2, ASTC LDR) (flutter/flutter#187281) 2026-06-02 bdero@google.com [Impeller] Allow attaching specific texture mip levels and slices (flutter/flutter#187066) 2026-06-02 bdero@google.com [Impeller] Fix GLES command submission status before context is current (flutter/flutter#187293) 2026-06-02 engine-flutter-autoroll@skia.org Roll Dart SDK from 3cdc25e8ffe9 to d39850bf4a01 (9 revisions) (flutter/flutter#187409) 2026-06-01 jason-simmons@users.noreply.github.com [Impeller] Use glVertexAttribDivisor on GLES3 and glVertexAttribDivisorEXT on GLES2 with the extension (flutter/flutter#187313) 2026-06-01 matt.boetger@gmail.com [Android] Add Javadoc documentation to TextInputChannel (flutter/flutter#186018) 2026-06-01 mvincentong@gmail.com Read FLTEnableWideGamut from Dart bundle (flutter/flutter#186509) 2026-06-01 matt.boetger@gmail.com [flutter_tools] Remove obsolete AndroidX console warning during Gradle builds (flutter/flutter#186077) 2026-06-01 kjlubick@users.noreply.github.com [skia] Update gni file list name hsw -> ml3 (flutter/flutter#184892) 2026-06-01 zhongliu88889@gmail.com [web] Always sync slider input attrs regardless of gesture mode (flutter/flutter#187217) 2026-06-01 zhongliu88889@gmail.com [flutter_driver] Don't throw when stderr is unavailable on web (flutter/flutter#187190) 2026-06-01 116356835+AbdeMohlbi@users.noreply.github.com Remove unused code in `FlutterPluginUtils.kt` (flutter/flutter#187012) 2026-06-01 taak140@gmail.com [flutter_tools] Fix `flutter drive --chrome-binary` being ignored on web (flutter/flutter#185481) 2026-06-01 davidmartos96@gmail.com Eager failure when building and no XCode build settings (flutter/flutter#184726) 2026-06-01 goung123@gmail.com Fix Windows Korean IME caret position during composition (flutter/flutter#186353) 2026-06-01 okorohelijah@google.com iOS: update provisioning profile for 2026-2027 cert (flutter/flutter#187280) 2026-06-01 154381524+flutteractionsbot@users.noreply.github.com Sync CHANGELOG.md from stable (flutter/flutter#187380) 2026-06-01 jason-simmons@users.noreply.github.com Reland "Move dart-lang/ai to a top level third party dependency in engine (#187268)" (flutter/flutter#187378) 2026-06-01 stuartmorgan@google.com Add vector_math to Framework triage (flutter/flutter#187389) 2026-06-01 engine-flutter-autoroll@skia.org Roll Packages from e930ced to f5d50ca (4 revisions) (flutter/flutter#187381) 2026-06-01 mr_nadeem_iqbal@yahoo.com [flutter_tools] Reject archive entries that escape into a sibling directory by name prefix (#185794) (flutter/flutter#186647) 2026-06-01 bkonyi@google.com [flutter_tools] Fix widget_preview unawaited async write race condition (flutter/flutter#187177) 2026-06-01 137456488+flutter-pub-roller-bot@users.noreply.github.com Roll pub packages (flutter/flutter#187375) 2026-06-01 engine-flutter-autoroll@skia.org Roll Skia from 0aee4675e0ad to c97e939eb5c9 (7 revisions) (flutter/flutter#187371) 2026-06-01 mr_nadeem_iqbal@yahoo.com docs: Stack.clipBehavior = Clip.none does not extend hit testing (#160787) (flutter/flutter#186643) If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/flutter-packages Please CC stuartmorgan@google.com,tarrinneal@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Packages: https://github.com/flutter/flutter/issues/new/choose To report a problem with the AutoRoller itself, please file a bug: https://issues.skia.org/issues/new?component=1389291&template=1850622 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md

…ectory by name prefix (flutter#185794) (flutter#186647) `_WindowsUtils._unpackArchive` in `packages/flutter_tools/lib/src/base/os.dart` validates that each archive entry resolves inside the target directory before writing it. The existing check compared the canonical destination path to the canonical target path with `startsWith`, which is vulnerable to prefix confusion: a target of `bin\cache\artifacts\engine\windows-x64` and a canonical destination of `bin\cache\artifacts\engine\windows-x64-profile\poc_marker.txt` (as produced by a crafted entry like `..\windows-x64-profile\poc_marker.txt`) returns `true` because the destination path starts with the target path as a string, even though it is a sibling directory. Replaced the `startsWith` check with `path.isWithin`, which compares full path components, and hoisted the `targetDirectoryCanonicalPath` calculation out of the per-entry loop. Added a regression test covering the prefix-confusion case in `packages/flutter_tools/test/general.shard/base/os_test.dart`; existing `..\..\` test continues to pass. Fixes flutter#185794. ## Pre-launch Checklist - [x] I read the [Contributor Guide] and followed the process outlined there for submitting PRs. - [x] I read the [AI contribution guidelines] and understand my responsibilities, or I am not using AI tools. - [x] I read the [Tree Hygiene] wiki page, which explains my responsibilities. - [x] I read and followed the [Flutter Style Guide], including [Features we expect every widget to implement]. - [x] I signed the [CLA]. - [x] I listed at least one issue that this PR fixes in the description above. - [x] I updated/added relevant documentation (doc comments with `///`). - [x] I added new tests to check the change I am making, or this PR is [test-exempt]. - [x] I followed the [breaking change policy] and added [Data Driven Fixes] where supported. - [x] All existing and new tests are passing.  [Contributor Guide]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#overview [AI contribution guidelines]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#ai-contribution-guidelines [Tree Hygiene]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md [test-exempt]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#tests [Flutter Style Guide]: https://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md [Features we expect every widget to implement]: https://github.com/flutter/flutter/blob/main/docs/contributing/Style-guide-for-Flutter-repo.md#features-we-expect-every-widget-to-implement [CLA]: https://cla.developers.google.com/ [breaking change policy]: https://github.com/flutter/flutter/blob/main/docs/contributing/Tree-hygiene.md#handling-breaking-changes [Data Driven Fixes]: https://github.com/flutter/flutter/blob/main/docs/contributing/Data-driven-Fixes.md --------- Co-authored-by: Ben Konyi <bkonyi@google.com>

github-actions Bot added the tool Affects the "flutter" command-line tool. See also t: labels. label May 17, 2026

gemini-code-assist Bot reviewed May 17, 2026

View reviewed changes

[flutter_tools] Hoist target canonical path out of _unpackArchive loop

a16f84e

Address review feedback (flutter#186647): the target directory does not change across archive entries, so canonicalize it once before iterating instead of per file.

bkonyi reviewed May 19, 2026

View reviewed changes

bkonyi added the CICD Run CI/CD label May 19, 2026

github-actions Bot removed the CICD Run CI/CD label May 23, 2026

bkonyi added the CICD Run CI/CD label May 25, 2026

bkonyi requested a review from chingjun May 25, 2026 17:57

bkonyi approved these changes May 25, 2026

View reviewed changes

chingjun approved these changes May 26, 2026

View reviewed changes

chingjun added the autosubmit Merge PR when tree becomes green via auto submit App label May 26, 2026

auto-submit Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label May 26, 2026

Merge branch 'master' into nadeem/185794-unpack-archive-prefix-confusion

97bf1a2

github-actions Bot removed the CICD Run CI/CD label May 26, 2026

bkonyi added CICD Run CI/CD autosubmit Merge PR when tree becomes green via auto submit App labels May 26, 2026

auto-submit Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label May 26, 2026

bkonyi added the autosubmit Merge PR when tree becomes green via auto submit App label Jun 1, 2026

auto-submit Bot added this pull request to the merge queue Jun 1, 2026

Merged via the queue into flutter:master with commit 3af9fcb Jun 1, 2026
171 of 172 checks passed

flutter-dashboard Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Jun 1, 2026

This was referenced Jun 2, 2026

Roll Flutter from 54e199ac49e0 to 701665b97818 (26 revisions) flutter/packages#11821

Closed

Roll Flutter from 54e199ac49e0 to 701665b97818 (26 revisions) flutter/packages#11822

Merged

Piinks mentioned this pull request Jun 5, 2026

Flutter Notable Commits - 2026 #181433

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[flutter_tools] Reject archive entries that escape into a sibling directory by name prefix (#185794)#186647

[flutter_tools] Reject archive entries that escape into a sibling directory by name prefix (#185794)#186647
auto-submit[bot] merged 4 commits into
flutter:masterfrom
NadeemIqbal:nadeem/185794-unpack-archive-prefix-confusion

NadeemIqbal commented May 17, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 17, 2026

Uh oh!

gemini-code-assist Bot May 17, 2026

Uh oh!

bkonyi May 19, 2026

Uh oh!

bkonyi left a comment

Uh oh!

bkonyi May 19, 2026

Uh oh!

bkonyi May 19, 2026

Uh oh!

auto-submit Bot commented May 26, 2026

Uh oh!

auto-submit Bot commented May 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	if (!_fileSystem.path.isWithin(targetDirectoryCanonicalPath, destinationFileCanonicalPath)) {
	if (!_fileSystem.path.isWithin(targetDirectoryCanonicalPath, destinationFileCanonicalPath) &&
	!_fileSystem.path.equals(targetDirectoryCanonicalPath, destinationFileCanonicalPath)) {

Uh oh!

Conversation

NadeemIqbal commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pre-launch Checklist

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 17, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 17, 2026

Choose a reason for hiding this comment

Uh oh!

bkonyi May 19, 2026

Choose a reason for hiding this comment

Uh oh!

bkonyi left a comment

Choose a reason for hiding this comment

Uh oh!

bkonyi May 19, 2026

Choose a reason for hiding this comment

Uh oh!

bkonyi May 19, 2026

Choose a reason for hiding this comment

Uh oh!

auto-submit Bot commented May 26, 2026

Uh oh!

auto-submit Bot commented May 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

NadeemIqbal commented May 17, 2026 •

edited

Loading