This lesson's interactive features are locked, please to keep using them

Safe Archive Extraction

Archive extraction needs to validate each entry against a trusted root. In Go, filepath.Rel describes how to reach a candidate destination from that root:

relativePath, err := filepath.Rel(root, destination)
if err != nil ||
    relativePath == "" ||
    relativePath == ".." ||
    strings.HasPrefix(relativePath, ".."+string(filepath.Separator)) ||
    filepath.IsAbs(relativePath) {
    return errors.New("archive entry escapes the extraction directory")
}

Rejecting the root, its parent, paths beneath its parent, and absolute relative results keeps accepted destinations inside the intended directory. Entry names also need platform-aware checks: an absolute name, a Windows-style backslash path, or a symbolic link should not be treated as an ordinary document path.

Validate Before Writing

Validate every entry before extracting any of them. If the fifth entry is malicious but the first four have already been written, the rejected archive still leaves partial data behind.

Zip Bombs

Path safety is only one archive boundary. Compressed input can expand dramatically, so production systems should also limit the number of entries and their total uncompressed size. Otherwise, a zip bomb can exhaust memory or disk space and cause a denial of service.

Assignment

Bearly Secure plans every ZIP entry before writing it, but it does not validate the planned paths. Reject the entire archive when any entry could escape or redirect extraction.

In internal/uploads/archive.go, implement isInsideDirectory with a relative path from the trusted directory to the candidate. Reject errors, the root itself, its parent, paths outside it, and absolute results.
Before planning an entry, reject absolute names, names containing backslashes, destinations outside the import directory, and symbolic links.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.