https://nalar.dev/tags/archive-security/ Recent content in Archive Security on Nalar Hugo en-us Fri, 11 Sep 2026 00:00:00 +0700 https://nalar.dev/secure-archive-extraction-against-path-traversal/ Fri, 11 Sep 2026 00:00:00 +0700 https://nalar.dev/secure-archive-extraction-against-path-traversal/ <p>Archive extraction looks simple: open a ZIP or TAR file, iterate over its entries, and write each entry under a destination directory. The dangerous detail is that archive entries carry names and, in some formats, filesystem object types. Those fields come from the archive creator.</p> <p>If extraction code joins an untrusted entry name to a trusted destination without enforcing containment, an entry such as <code>../../app/config.json</code> can escape the intended directory. A crafted archive can then overwrite files that the application account is permitted to modify.</p>