Automattic / Automattic/jetpack
Feature Request: Show more descriptive error on failure to download compressed files
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
### Impacted plugin
Jetpack
### What
Add a descriptive error if a compressed file fails to download for security reasons
### How
If you upload a .zip file that contains an executable file (.bat for example) to a site, you will not be able to download it. A generic error will be displayed: "This site can't be reached".
Screenshot of the error: 
If you remove the .bat file, you will be able to download the .zip file correctly. Ideally, the user should see a warning when uploading this type of file, or the error page displayed could be more specific.
Contributor guide
Research direction
Start by tracing Jetpack's handling of compressed-file uploads and downloads, reproducing the .zip-with-.bat case described in the issue. The work is done when users receive a specific security-related warning or error instead of the generic unreachable-site message; the payload names no files or tests to start from.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100