From f235ce411f109703b3dedc547cbacadb4aab82cf Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Wed, 9 Sep 2026 17:01:32 +0200 Subject: [PATCH] Potential fix for code scanning alert no. 6: Arbitrary file access during archive extraction ("Zip Slip") Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- internal/bt/gitrepo/gitrepo.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/internal/bt/gitrepo/gitrepo.go b/internal/bt/gitrepo/gitrepo.go index f554412..f2ad522 100644 --- a/internal/bt/gitrepo/gitrepo.go +++ b/internal/bt/gitrepo/gitrepo.go @@ -405,7 +405,19 @@ func restoreZip(archive, destination string) error { return err } for _, file := range reader.File { - target := filepath.Join(destination, filepath.FromSlash(file.Name)) + if file.Name == "" { + return fmt.Errorf("unsicherer ZIP-Pfad erkannt: %s", file.Name) + } + entryPath := filepath.Clean(filepath.FromSlash(file.Name)) + if entryPath == "." || entryPath == ".." || + strings.HasPrefix(entryPath, ".."+string(os.PathSeparator)) || + strings.Contains(entryPath, string(os.PathSeparator)+".."+string(os.PathSeparator)) || + strings.HasSuffix(entryPath, string(os.PathSeparator)+"..") || + filepath.IsAbs(entryPath) || + filepath.VolumeName(entryPath) != "" { + return fmt.Errorf("unsicherer ZIP-Pfad erkannt: %s", file.Name) + } + target := filepath.Join(destination, entryPath) resolved, err := filepath.Abs(target) if err != nil { return err