Zip Slip (ARCH9106)
Esta página aún no está disponible en tu idioma.
Key swift.security.zip-slip · Severity error · Category security · CWE CWE-22
Flags archive entry paths appended to a target directory without checking the resolved path stays inside it.
Incorrect
Section titled “Incorrect”let out = dir.appendingPathComponent(entry.path)Correct
Section titled “Correct”let out = dir.appendingPathComponent(entry.path).standardizedguard out.path.hasPrefix(dir.path + "/") else { throw ZipError.escape }Standardise the resolved URL and reject entries that escape the target directory.