Zip Slip (ARCH3106)

Key typescript.security.zip-slip · Severity error · Category security · CWE CWE-22

Writing archive entry paths to disk without checking they stay inside the target directory allows path traversal during extraction via ../ entry names.

Incorrect

for (const entry of zip.getEntries()) {
  // entry.entryName = "../../etc/cron.d/evil"
  fs.writeFileSync(path.join(dest, entry.entryName), entry.getData());
}

Correct

for (const entry of zip.getEntries()) {
  const full = path.resolve(dest, entry.entryName);
  if (!full.startsWith(dest + path.sep)) throw new Error("Zip Slip");
  fs.writeFileSync(full, entry.getData());
}

Fix

Verify each entry’s resolved path stays inside the target directory before writing.