Zip Slip path traversal (ARCH336)

Key dotnet.security.zip-slip · Severity warning · Category security · CWE CWE-22

Combining archive entry names into file paths without validation lets entries containing ../ write outside the target directory. This can overwrite system files.

Incorrect

foreach (var entry in archive.Entries)
{
    var path = Path.Combine(targetDir, entry.FullName);
    entry.ExtractToFile(path, overwrite: true);
}

Correct

var root = Path.GetFullPath(targetDir);
foreach (var entry in archive.Entries)
{
    var path = Path.GetFullPath(Path.Combine(root, entry.FullName));
    if (!path.StartsWith(root + Path.DirectorySeparatorChar))
        throw new IOException("Invalid archive entry");

    entry.ExtractToFile(path, overwrite: true);
}

Fix

Before extracting, resolve each entry’s full path and verify it stays inside the target root directory; otherwise reject the operation.