Zip slip (ARCH6106)

Key ruby.security.zip-slip · Severity error · Category security · CWE CWE-22

Writing archive entry paths to disk without validation lets entries containing ../ be written outside the target directory, enabling path traversal during unzip.

Incorrect

Zip::File.open(archive) do |zip|
  zip.each { |entry| entry.extract(File.join(dest, entry.name)) }
end

Correct

root = File.expand_path(dest)
Zip::File.open(archive) do |zip|
  zip.each do |entry|
    path = File.expand_path(File.join(root, entry.name))
    raise "zip slip" unless path.start_with?("#{root}/")
    entry.extract(path)
  end
end

Fix

Resolve each entry’s destination and verify it stays inside the target root; reject extraction otherwise.