Prevent Zip Slip when using ArchiveFileStreamContext to decompress

Fixes wixtoolset/issues#6075
firegiant · Sep 17, 2019 · dadd0a6 · dadd0a6
1 parent 88d93f6
commit dadd0a6
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/history/zipslip.md b/history/zipslip.md
@@ -0,0 +1 @@
+* RobMen: WIXBUG:6075 - Fix "Zip Slip" vulnerability in DTF.
diff --git a/src/DTF/Libraries/Compression/ArchiveFileStreamContext.cs b/src/DTF/Libraries/Compression/ArchiveFileStreamContext.cs
@@ -638,6 +638,8 @@ private string TranslateFilePath(string path)
 
             if (filePath != null)
             {
+                this.ValidateArchivePath(filePath);
+
                 if (this.directory != null)
                 {
                     filePath = Path.Combine(this.directory, filePath);
@@ -647,6 +649,16 @@ private string TranslateFilePath(string path)
             return filePath;
         }
 
+        private void ValidateArchivePath(string filePath)
+        {
+            string basePath = Path.GetFullPath(String.IsNullOrEmpty(this.directory) ? Environment.CurrentDirectory : this.directory);
+            string path = Path.GetFullPath(Path.Combine(basePath, filePath));
+            if (!path.StartsWith(basePath, StringComparison.InvariantCultureIgnoreCase))
+            {
+                throw new InvalidDataException("Archive cannot contain files with absolute or traversal paths.");
+            }
+        }
+
         #endregion
     }
 }