Create consistent sanitisation of zip and tar path entries
@spbolton is already working on this.
Since May 16, 2025.
- #32190 by @spbolton — closed without merging
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
User Story
As a developer, I want to be able to handle the compression and extration of tar and zip archives in a consistent way knowing that I am not creating archives with absolute paths or relative path expressions like .. that could cause problems on systems extracting them, or be flagged as a possible security risk, and also that I am not liable to files being extracted outside of their intended destination.
Acceptance Criteria
This should not break existing functionality
Utility functions should be provided that allow for ongoing use wherever we need to compress or uncompress an archive in the system.
Proposed Objective
Security & Privacy
Proposed Priority
Priority 2 - Important
External Links... Slack Conversations, Support Tickets, Figma Designs, etc.
No response
Assumptions & Initiation Needs
No response
Quality Assurance Notes & Workarounds
No response
Sub-Tasks & Estimates
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.