From 12329dbcf241f6d9523047a6784ca1eb3bdeb05c Mon Sep 17 00:00:00 2001 From: ShadowDara Date: Sun, 13 Sep 2026 22:48:04 +0200 Subject: [PATCH] Potential fix for code scanning alert no. 7: Arbitrary file access during archive extraction ("Zip Slip") Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- internal/bt/gitrepo/gitrepo.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/internal/bt/gitrepo/gitrepo.go b/internal/bt/gitrepo/gitrepo.go index f2ad5224..35df566f 100644 --- a/internal/bt/gitrepo/gitrepo.go +++ b/internal/bt/gitrepo/gitrepo.go @@ -404,6 +404,10 @@ func restoreZip(archive, destination string) error { if err := os.MkdirAll(destination, 0755); err != nil { return err } + rootAbs, err := filepath.Abs(destination) + if err != nil { + return err + } for _, file := range reader.File { if file.Name == "" { return fmt.Errorf("unsicherer ZIP-Pfad erkannt: %s", file.Name) @@ -417,13 +421,16 @@ func restoreZip(archive, destination string) error { filepath.VolumeName(entryPath) != "" { return fmt.Errorf("unsicherer ZIP-Pfad erkannt: %s", file.Name) } - target := filepath.Join(destination, entryPath) + target := filepath.Join(rootAbs, entryPath) resolved, err := filepath.Abs(target) if err != nil { return err } - root, _ := filepath.Abs(destination) - if resolved != root && !strings.HasPrefix(resolved, root+string(os.PathSeparator)) { + rel, err := filepath.Rel(rootAbs, resolved) + if err != nil { + return err + } + if rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) || filepath.IsAbs(rel) { return fmt.Errorf("unsicherer ZIP-Pfad erkannt: %s", file.Name) } if file.Name == "gitpack.json" {