You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When the sample code is used in any application that extracts zip-files from foreign people it probably will be possible to run malicious code on the computer this extracting application is running on by replacing executable files anywhere on the PC.
Steps to reproduce
Use 7zip to create a .zip-Archive with the following folder Structure: zip-root -> "C:" -> "subdir" -> "keks.txt" (screenshot)
Run the example code from the wiki page to extract the zip file you just created.
Look what's on your C:\ drive :P
I haven't checked the code of the library itself for more of these errors, but someone probably should do this.
The text was updated successfully, but these errors were encountered:
This is not a bug per se, but perhaps a general security concern. The behavior of Path.Combine might not be intuitive for some, but it's not really the scope of this project.
I'd probably accept a PR with a comment warning about how absolute paths will behave in regards to Path.Combine.
As I explained here and pointed out in bug reports against other libraries with the same bug, it isn't safe to use Path.Combine() and therefor it shouldn't be recommended by sample codes like in your wiki: https://github.com/icsharpcode/SharpZipLib/wiki/Zip-Samples#unpack-a-zip-with-full-control-over-the-operation
When the sample code is used in any application that extracts zip-files from foreign people it probably will be possible to run malicious code on the computer this extracting application is running on by replacing executable files anywhere on the PC.
Steps to reproduce
I haven't checked the code of the library itself for more of these errors, but someone probably should do this.
The text was updated successfully, but these errors were encountered: