Zip Slip (ARCH9106)

Key swift.security.zip-slip · Severity error · Category security · CWE CWE-22

Flags archive entry paths appended to a target directory without checking the resolved path stays inside it.

Incorrect

let out = dir.appendingPathComponent(entry.path)

Correct

let out = dir.appendingPathComponent(entry.path).standardized
guard out.path.hasPrefix(dir.path + "/") else { throw ZipError.escape }

Fix

Standardise the resolved URL and reject entries that escape the target directory.