Mirrors/dioxus
2
0
Fork 0
mirror of https://github.com/DioxusLabs/dioxus synced 2024-11-26 22:20:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

fix(cli): prevent "zip slip" vulnerability in tool extract

Browse source 
Using the name directly from a zip archive's entry and writing to it is a potential security vulnerability. More information about the vulnerability can be found here: https://security.snyk.io/research/zip-slip-vulnerability and here https://docs.rs/zip/latest/zip/read/struct.ZipFile.html#warnings.

It looks like the previous version maybe tried to remove `\` characters to prevent this, but only in directory paths?
This commit is contained in:
Brian Donovan 2023-08-04 20:02:07 -07:00
parent 7a7397bbb4
commit 14e7c50478
No known key found for this signature in database
1 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
packages/cli/src/tools.rs
View file

@ -328,20 +328,26 @@ pub fn extract_zip(file: &Path, target: &Path) -> anyhow::Result<()> {
}
for i in 0..zip.len() {
let mut file = zip.by_index(i)?;
if file.is_dir() {
let mut zip_entry = zip.by_index(i)?;
let Some(enclosed_name) = zip_entry.enclosed_name() else {
return Err(anyhow::anyhow!(
"Refusing to unpack zip entry with potentially dangerous path: zip={} entry={:?}",
file.display(),
zip_entry.name()
));
};
let output_path = target.join(enclosed_name);
if zip_entry.is_dir() {
// dir
let target = target.join(Path::new(&file.name().replace('\\', "")));
std::fs::create_dir_all(target)?;
std::fs::create_dir_all(output_path)?;
} else {
// file
let file_path = target.join(Path::new(file.name()));
let mut target_file = if !file_path.exists() {
std::fs::File::create(file_path)?
let mut target_file = if !output_path.exists() {
std::fs::File::create(output_path)?
} else {
std::fs::File::open(file_path)?
std::fs::File::open(output_path)?
};
let _num = std::io::copy(&mut file, &mut target_file)?;
let _num = std::io::copy(&mut zip_entry, &mut target_file)?;
}
}