Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Example code introduces very big security flaw because of Path.Combine() #180

Closed
MarcusWichelmann opened this issue May 30, 2017 · 1 comment

Comments

@MarcusWichelmann
Copy link

As I explained here and pointed out in bug reports against other libraries with the same bug, it isn't safe to use Path.Combine() and therefor it shouldn't be recommended by sample codes like in your wiki: https://github.com/icsharpcode/SharpZipLib/wiki/Zip-Samples#unpack-a-zip-with-full-control-over-the-operation

When the sample code is used in any application that extracts zip-files from foreign people it probably will be possible to run malicious code on the computer this extracting application is running on by replacing executable files anywhere on the PC.

Steps to reproduce

  1. Use 7zip to create a .zip-Archive with the following folder Structure: zip-root -> "C:" -> "subdir" -> "keks.txt" (screenshot)
  2. Run the example code from the wiki page to extract the zip file you just created.
  3. Look what's on your C:\ drive :P

I haven't checked the code of the library itself for more of these errors, but someone probably should do this.

@piksel
Copy link
Member

piksel commented May 13, 2018

This is not a bug per se, but perhaps a general security concern. The behavior of Path.Combine might not be intuitive for some, but it's not really the scope of this project.

I'd probably accept a PR with a comment warning about how absolute paths will behave in regards to Path.Combine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants