class

Flaw::ZipSlip

Inherits Flaw::Rule < Reference < Object

FLAW022 — Zip-slip. Extracting archive entries whose names contain .. lets the attacker write outside the target directory.

Constants

PATTERNS = [/File\.open\s*\(\s*File\.join\([^)]*\bentry\.(?:name|filename|path)\b/, /File\.write\s*\(\s*File\.join\([^)]*\bentry\.(?:name|filename|path)\b/, /Dir\.mkdir\s*\(\s*File\.join\([^)]*\bentry\.(?:name|filename|path)\b/]

File.open(File.join(dest, entry.name), "w") without prior check

Instance methods

check(source : String, path : String) : Array(Finding)
Source
default_severity
Source
description
Source
title
Source