Expanding archive files is security-sensitive

Expanding archive files is security-sensitive. For example, expanding archive files has led in the past to the following vulnerabilities:

• CVE-2018-1263
• CVE-2018-16131

Applications that expand archive files (zip, tar, jar, war, 7z, ...) should verify the path where the archive's files are expanded and not trust blindly the content of the archive. Archive's files should not be expanded outside of the root directory where the archive is supposed to be expanded. Also, applications should control the size of the expanded data to not be a victim of Zip Bomb attack. Failure to do so could allow an attacker to use a specially crafted archive that holds directory traversal paths (e.g. ../../attacker.sh) or the attacker could overload the file system, processors or memory of the operating system where the archive is expanded making the target OS completely unusable.

This rule raises an issue when code handle archives. The goal is to guide security code reviews.

Ask Yourself Whether

• there is no validation of the name of the archive entry
• there is no validation of the effective path where the archive entry is going to be expanded
• there is no validation of the size of the expanded archive entry
• there is no validation of the ratio between the compressed and uncompressed archive entry

You are at risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

Validate the full path of the extracted file against the full path of the directory where files are expanded.

• the canonical path of the expanded file must start with the canonical path of the directory where files are extracted.
• the name of the archive entry must not contain "..", i.e. reference to a parent directory.

Stop extracting the archive if any of its entries has been tainted with a directory traversal path.

Define and control the ratio between compressed and uncompress bytes.

Define and control the maximum allowed expanded file size.

Count the number of file entries extracted from the archive and abort the extraction if their number is greater than a predefined threshold.

See

• OWASP Top 10 2017 Category A1 - Injection
• MITRE, CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
• CERT, IDS04-J. - Safely extract files from ZipInputStream
• Snyk Research Team: Zip Slip Vulnerability