Title: Introduced protections against "zip slip" attacks by pixeebot[bot] · Pull Request #32 · Pixee-Bot-Java/flow · GitHub
Open Graph Title: Introduced protections against "zip slip" attacks by pixeebot[bot] · Pull Request #32 · Pixee-Bot-Java/flow
X Title: Introduced protections against "zip slip" attacks by pixeebot[bot] · Pull Request #32 · Pixee-Bot-Java/flow
Description: This change updates all new instances of ZipInputStream to protect against malicious entries that attempt to escape their "file root" and overwrite other files on the running filesystem. Normally, when you're using ZipInputStream it's because you're processing zip files. That code might look like this: File file = new File(unzipTargetDirectory, zipEntry.getName()); // use file name from zip entry InputStream is = zip.getInputStream(zipEntry); // get the contents of the zip entry IOUtils.copy(is, new FileOutputStream(file)); // write the contents to the provided file name This looks fine when it encounters a normal zip entry within a zip file, looking something like this pseudo-data: path: data/names.txt contents: Zeus\nHelen\nLeda... However, there's nothing to prevent an attacker from sending an evil entry in the zip that looks more like this: path: ../../../../../etc/passwd contents: root::0:0:root:/:/bin/sh Yes, in the above code, which looks like every piece of zip-processing code you can find on the Internet, attackers could overwrite any files to which the application has access. This rule replaces the standard ZipInputStream with a hardened subclass which prevents access to entry paths that attempt to traverse directories above the current directory (which no normal zip file should ever do.) Our changes end up looking something like this: + import io.github.pixee.security.ZipSecurity; ... - var zip = new ZipInputStream(is, StandardCharsets.UTF_8); + var zip = ZipSecurity.createHardenedInputStream(is, StandardCharsets.UTF_8); More reading https://cwe.mitre.org/data/definitions/23 https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerability https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite I have additional improvements ready for this repo! If you want to see them, leave the comment: @pixeebot next ... and I will open a new PR right away! 🧚🤖 Powered by Pixeebot Feedback | Community | Docs | Codemod ID: pixee:java/harden-zip-entry-paths
Open Graph Description: This change updates all new instances of ZipInputStream to protect against malicious entries that attempt to escape their "file root" and overwrite other files on the running filesystem. ...
X Description: This change updates all new instances of ZipInputStream to protect against malicious entries that attempt to escape their "file root" and overwrite other files on the running file...
Opengraph URL: https://github.com/Pixee-Bot-Java/flow/pull/32
X: @github
Domain: patch-diff.githubusercontent.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:a1e4ec4f-34b5-7d4f-5c7c-acd80355cc1c |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | E8B2:5A3DD:1A108CC:20F9E09:69917BCB |
| html-safe-nonce | c0305bc448184798a46a417dda1a0d0843455bc4fdc9af39eb61c5ab4ddd7566 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFOEIyOjVBM0REOjFBMTA4Q0M6MjBGOUUwOTo2OTkxN0JDQiIsInZpc2l0b3JfaWQiOiIyMzg3NzgyMDQ0ODcwNjA1NzcxIiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | 1ff5f3be982bb00a457988c79fa65538d21c724a5a8b3e9d79efdfd6219717a2 |
| hovercard-subject-tag | pull_request:2661912052 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/Pixee-Bot-Java/flow/pull/32/files |
| twitter:image | https://avatars.githubusercontent.com/in/193111?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/in/193111?s=400&v=4 |
| og:image:alt | This change updates all new instances of ZipInputStream to protect against malicious entries that attempt to escape their "file root" and overwrite other files on the running filesystem. ... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 42c603b9d642c4a9065a51770f75e5e27132fef0e858607f5c9cb7e422831a7b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/Pixee-Bot-Java/flow git https://github.com/Pixee-Bot-Java/flow.git |
| octolytics-dimension-user_id | 143516492 |
| octolytics-dimension-user_login | Pixee-Bot-Java |
| octolytics-dimension-repository_id | 795756272 |
| octolytics-dimension-repository_nwo | Pixee-Bot-Java/flow |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | true |
| octolytics-dimension-repository_parent_id | 34809191 |
| octolytics-dimension-repository_parent_nwo | vaadin/flow |
| octolytics-dimension-repository_network_root_id | 34809191 |
| octolytics-dimension-repository_network_root_nwo | vaadin/flow |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 848bc6032dcc93a9a7301dcc3f379a72ba13b96e |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width