https://nalar.dev/tags/path-validation/ Recent content in Path Validation on Nalar Hugo en-us Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/keep-archive-extraction-inside-its-destination/ Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/keep-archive-extraction-inside-its-destination/ <p>Extracting an archive looks like a file-copying task: read each entry, join its name to a destination directory, and write the bytes. The security problem is that an archive entry name is input chosen by whoever created the archive. If that name can influence the output path without a containment check, extraction can write outside the directory the application intended to grant.</p> <p>The consequence is broader than a misplaced file. Depending on the process&rsquo;s permissions, an escaped write may replace application data, configuration, generated assets, or another file that the extractor can modify.</p>