Archive Security

Secure Archive Extraction Against Path Traversal

Archive extraction looks simple: open a ZIP or TAR file, iterate over its entries, and write each entry under a destination directory. The dangerous detail is that archive entries carry names and, in some formats, filesystem object types. Those fields come from the archive creator. If extraction code joins an untrusted entry name to a trusted destination without enforcing containment, an entry such as ../../app/config.json can escape the intended directory. A crafted archive can then overwrite files that the application account is permitted to modify.