Audit archive paths for traversal risks
Audit the member names and link targets of a ZIP or TAR archive for unsafe extraction behaviour.
Working…
Questions people ask
- What does the audit check?
- Two groups of rules. Name rules cover paths that would escape or ambush an extractor: parent-directory segments, absolute roots, drive-qualified and UNC paths, control characters, Windows device names, trailing dots and spaces, mixed separators, redundant self segments and two normalisation ambiguities, decomposed Unicode forms and names that case-fold to the same extraction path. Link rules resolve symbolic and hard link targets against the member's own directory and report targets that escape the archive root or point at an absolute location.
- Does a clean verdict mean the archive is safe?
- No, and the result says so in the same words. Clean means this audit's specific rules found nothing on the members they examined. It cannot speak for every extraction tool, every operating system's file handling, or attacks outside the rule set. Treat the report as an observation, not a clearance certificate.
- Is anything extracted or fetched?
- No. The audit reads the archive's directory records and, for ZIP symlinks, the stored target string of at most 4 KB per link. No member is extracted to disk, no link is followed, and nothing is fetched from the network, which the job does not even reach.
- How are findings reported?
- Every finding names its member, its rule and a short reason, classified as an error or a warning. The counts are kept for every rule even when the listed findings are capped at 200, and the complete report is the downloadable JSON. Errors are extraction-escape classes; warnings are ambiguities that could surprise an extractor without escaping the root.
- What is case-fold collision about?
- Two members with distinct names can collapse onto one path on systems that treat case-insensitively or fold Unicode forms, which replaces a file silently. The audit reports such pairs as warnings: not escapes, but extraction surprises worth knowing about. Paths in different case are not mixed at other times; on case-sensitive systems both members extract as they are.
- What happens if the archive is very large?
- Up to 4096 members are audited individually. Anything beyond is counted as unaudited, the verdict gains a partial marker, and the report states how many members were not examined. An unaudited archive is never reported as clean.