This lesson's interactive features are locked, please to keep using them

Unsafe Archive Extraction

A ZIP archive is not a single document. It is a container whose entries each have a name such as july/invoice.pdf. Extracting an untrusted archive turns those names into paths on your server.

Path Traversal

Imagine an invoice service that joins every entry name to a trusted extraction directory:

for _, entry := range archive.File {
    destination := filepath.Join(extractionDirectory, entry.Name)
    // Write the entry to destination.
}

filepath.Join cleans the resulting path, but it does not prove that the destination remains inside extractionDirectory. An entry named ../../bearly-secure.log can escape the trusted directory after path normalization.

This vulnerability is commonly called Zip Slip. ZIP is only the delivery mechanism; the same path-traversal problem can occur whenever application code turns untrusted names into filesystem paths.

Checking the uploaded archive's filename or MIME type does not help. The dangerous paths are inside the archive, and every entry has its own attacker-controlled name.