GXCompress .NET implementation#1108
Merged
Merged
Conversation
tomas-sexenian
had a problem deploying
to
external-storage-tests
GitHub Actions
Failure
tomas-sexenian
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
tomas-sexenian
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Cherry pick to beta failed, 1 conflicted file in commit 0e4f16d
|
Contributor
Manual cherry pick to beta success |
Contributor
tomas-sexenian
had a problem deploying
to
external-storage-tests
GitHub Actions
Failure
Contributor
tomas-sexenian
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Cherry pick to beta success |
sgrampone
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Cherry pick to beta failed, 1 conflicted file in commit 4a4bfbd
|
Contributor
Manual cherry pick to beta success |
sgrampone
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Cherry pick to beta success |
Contributor
Cherry pick to beta success |
claudiamurialdo
had a problem deploying
to
external-storage-tests
GitHub Actions
Failure
Contributor
Cherry pick to beta success |
claudiamurialdo
had a problem deploying
to
external-storage-tests
GitHub Actions
Failure
Contributor
Cherry pick to beta failed, 1 conflicted file in commit c02af46
|
claudiamurialdo
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Manual cherry pick to beta success |
Contributor
Cherry pick to beta success |
| { | ||
| foreach (var entry in archive.Entries) | ||
| { | ||
| string fullPath = Path.Combine(outputPath, entry.FullName); |
Check failure
Code scanning / CodeQL
Arbitrary file access during archive extraction ("Zip Slip")
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we need to validate the paths derived from entry.FullName to ensure they do not escape the intended outputPath directory. The fix involves:
- Using
Path.GetFullPathto resolve the full path of the constructed file path (fullPath). - Using
Path.GetFullPathto resolve the full path of theoutputPathdirectory, ensuring it ends with a directory separator. - Verifying that the resolved
fullPathstarts with the resolvedoutputPath. If it does not, an exception is thrown. - Applying the same validation logic to both
DecompressZipandDecompressJarmethods.
Suggested changeset
1
dotnet/src/dotnetframework/GxCompress/GXCompressor.cs
| @@ -604,3 +604,8 @@ | ||
| { | ||
| string fullPath = Path.Combine(outputPath, entry.FullName); | ||
| string fullPath = Path.GetFullPath(Path.Combine(outputPath, entry.FullName)); | ||
| string fullOutputPath = Path.GetFullPath(outputPath + Path.DirectorySeparatorChar); | ||
| if (!fullPath.StartsWith(fullOutputPath, StringComparison.Ordinal)) | ||
| { | ||
| throw new InvalidOperationException($"Entry is outside the target directory: {entry.FullName}"); | ||
| } | ||
| if (string.IsNullOrEmpty(entry.Name)) | ||
| @@ -620,3 +625,2 @@ | ||
| #endif | ||
|
|
||
| entry.ExtractToFile(fullPath, true); | ||
| @@ -743,3 +747,8 @@ | ||
| { | ||
| string destinationPath = Path.Combine(outputPath, entry.FullName); | ||
| string destinationPath = Path.GetFullPath(Path.Combine(outputPath, entry.FullName)); | ||
| string fullOutputPath = Path.GetFullPath(outputPath + Path.DirectorySeparatorChar); | ||
| if (!destinationPath.StartsWith(fullOutputPath, StringComparison.Ordinal)) | ||
| { | ||
| throw new InvalidOperationException($"Entry is outside the target directory: {entry.FullName}"); | ||
| } | ||
| if (string.IsNullOrEmpty(entry.Name)) |
Copilot is powered by AI and may make mistakes. Always verify output.
| { | ||
| foreach (var entry in archive.Entries) | ||
| { | ||
| string destinationPath = Path.Combine(outputPath, entry.FullName); |
Check failure
Code scanning / CodeQL
Arbitrary file access during archive extraction ("Zip Slip")
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we need to validate and sanitize the paths derived from entry.FullName to ensure they do not escape the intended outputPath. The fix involves:
- Using
Path.GetFullPathto resolve the full path of the destination file, which normalizes the path and resolves any directory traversal elements. - Using
Path.GetFullPathon theoutputPathto determine the fully resolved path of the destination directory. - Validating that the resolved destination file path starts with the resolved destination directory path. If it does not, an exception is thrown.
- Proceeding with file extraction only if the validation passes.
This ensures that all extracted files remain within the intended directory.
Suggested changeset
1
dotnet/src/dotnetframework/GxCompress/GXCompressor.cs
| @@ -743,3 +743,8 @@ | ||
| { | ||
| string destinationPath = Path.Combine(outputPath, entry.FullName); | ||
| string destinationPath = Path.GetFullPath(Path.Combine(outputPath, entry.FullName)); | ||
| string fullOutputPath = Path.GetFullPath(outputPath + Path.DirectorySeparatorChar); | ||
| if (!destinationPath.StartsWith(fullOutputPath, StringComparison.Ordinal)) | ||
| { | ||
| throw new InvalidOperationException($"Entry is outside the target directory: {entry.FullName}"); | ||
| } | ||
| if (string.IsNullOrEmpty(entry.Name)) |
Copilot is powered by AI and may make mistakes. Always verify output.
…to include only the minimum required support for .NET Framework in GAM.
claudiamurialdo
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Cherry pick to beta success |
claudiamurialdo
temporarily deployed
to
kafka-integration-tests
GitHub Actions
Inactive
claudiamurialdo
temporarily deployed
to
external-storage-tests
GitHub Actions
Inactive
Contributor
Cherry pick to beta success |
tomas-sexenian
temporarily deployed
to
kafka-integration-tests
GitHub Actions
Inactive
tomas-sexenian
had a problem deploying
to
external-storage-tests
GitHub Actions
Failure
claudiamurialdo
approved these changes
Jul 15, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.