Zip Slip (ARCH5106)

Key go.security.zip-slip · Severity error · Category security · CWE CWE-22

Writing archive entry names to disk without validation lets entries containing ../ be written outside the target directory, for example overwriting system files.

Incorrect

func extract(dst string, f *zip.File) error {
  path := filepath.Join(dst, f.Name)
  out, err := os.Create(path)
  if err != nil {
    return err
  }
  defer out.Close()
  rc, _ := f.Open()
  _, err = io.Copy(out, rc)
  return err
}

Correct

func extract(dst string, f *zip.File) error {
  path := filepath.Join(dst, f.Name)
  if !strings.HasPrefix(path, filepath.Clean(dst)+string(os.PathSeparator)) {
    return fmt.Errorf("illegal path: %s", f.Name)
  }
  out, err := os.Create(path)
  if err != nil {
    return err
  }
  defer out.Close()
  rc, _ := f.Open()
  _, err = io.Copy(out, rc)
  return err
}

Fix

Validate each archive entry’s destination path and ensure the resolved path stays within the target directory.