File path traversal when extracting zip archive GSC-G305
File traversal when extracting zip/tar archive
123 return err
124 }
125
126 file := filepath.Join(target, h.Name)127
128 switch h.Typeflag {
129 case tar.TypeDir:
Description
A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.
Manipulating variables that reference files with “dot-dot (..)” sequences and their variations or using absolute file paths may be possible to access arbitrary files and directories stored on the file system, including application source code or configuration and critical system files.
Bad practice
package main
import (
"archive/zip"
"io/ioutil"
"path/filepath"
)
func unzip(f string) {
r, _ := zip.OpenReader(f)
for _, f := range r.File {
p, _ := filepath.Abs(f.Name)
// Bad: Could overwrite any file on the file system
ioutil.WriteFile(p, []byte("dummy"), 0666)
}
}
Recommended
package main
import (
"archive/zip"
"io/ioutil"
"path/filepath"
"strings"
)
func unzipGood(f string) {
r, _ := zip.OpenReader(f)
for _, f := range r.File {
p, _ := filepath.Abs(f.Name)
// Good: Check that path does not contain ".." before using it
// If this check is ignored then there's a possibility of
// arbitrary file write during zip extraction - "zip slip".
if !strings.Contains(p, "..") {
ioutil.WriteFile(p, []byte("present"), 0666)
}
}
}