Zip Slip (ARCH8106)
Key kotlin.security.zip-slip · Severity error · Category security · CWE CWE-22
Flags a zip entry name joined onto a target directory (File(dir, entry.name)) without checking the canonical path stays inside it.
Incorrect
Section titled “Incorrect”val out = File(dir, entry.name)Correct
Section titled “Correct”val out = File(dir, entry.name)require(out.canonicalPath.startsWith(dir.canonicalPath + File.separator))Canonicalise the resolved path and reject entries that escape the target directory.