You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It could be possible to create a zip archive with: ../../../../../some_file to achieve path traversal here.
We should investigate whether this could be detected. I think if we detect filepath.Join inclusive of zip.File type, without sanitisation, and the use of that identifier in a write operation you could get a fairly high confidence here.
The text was updated successfully, but these errors were encountered:
It would be fairly typical to include the file path from the zip file when extracting it's contents to disk
like in this:
(original source)
It could be possible to create a zip archive with:
../../../../../some_file
to achieve path traversal here.We should investigate whether this could be detected. I think if we detect filepath.Join inclusive of zip.File type, without sanitisation, and the use of that identifier in a write operation you could get a fairly high confidence here.
The text was updated successfully, but these errors were encountered: