Dashboard › institutional-transition-lab › ZipInfo special-file metadata

ZipInfo special-file metadata

Category: gotcha

Confidence: 1.00

ID: 01a084a4-c991-7542-bdac-cecf8af5a419

Project ID: 1fa3712f-997f-4884-b7ec-8abb79f9e342

Cross-project: No

Recalled in other projects: 0

Source session: 1ZjgTYcT8eC9K18gr

Created: 2026-09-09 05:29:47

Updated: 2026-09-09 05:29:47

Content

Trap: validating ZIP names and sizes looks sufficient because members are read as bytes, but ZipInfo metadata can identify Unix symlinks/devices/FIFOs/sockets or DOS directory/device/volume entries. Fix: scan every entry’s creator system and attributes, allow only unambiguous regular files, and reject unknown creator systems, special attributes, and directory names or mode bits.