Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

archive/zip: allows writing data for a directory #24043

Closed
dsnet opened this issue Feb 22, 2018 · 4 comments
Closed

archive/zip: allows writing data for a directory #24043

dsnet opened this issue Feb 22, 2018 · 4 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Milestone

Comments

@dsnet
Copy link
Member

dsnet commented Feb 22, 2018

Consider the following:

bb := new(bytes.Buffer)
zw := zip.NewWriter(bb)
w, _ := zw.Create("blah/")
if _, err := w.Write([]byte("Hello, world!")); err == nil {
    fmt.Println("unexpected Write success")
}
zw.Close()

A trailing forward-slash indicates intent to encode a directory. The API for Create and CreateHeader returns an io.Writer, which allows a user to write "data" for a directory, which has no sensible meaning. It turns out that the Writer does actually encode the data into the archive, but the various zip readers I tested just ignore the data.

I believe the io.Writer returned by Create and CreateHeader should just return an error.

@dsnet dsnet changed the title archive/zip: allows creation of invalid directories archive/zip: allows writing data for a directory Feb 22, 2018
@dsnet dsnet added this to the Go1.11 milestone Feb 22, 2018
@bradfitz
Copy link
Contributor

SGTM

@gopherbot
Copy link

Change https://golang.org/cl/97015 mentions this issue: archive/zip: CreateHeader does not allows writing data for a directory.

@andybons andybons added the NeedsFix The path to resolution is known, but the work has not been done. label Mar 26, 2018
@gopherbot
Copy link

Change https://golang.org/cl/102935 mentions this issue: archive/zip: disabled possibility to write to folder

@gopherbot
Copy link

Change https://golang.org/cl/108615 mentions this issue: archive/zip: prevent writing data for a directory

willmurphyscode pushed a commit to cloudfoundry/cli that referenced this issue Nov 14, 2018
- Stop asserting the compression mode on directories in zip archives
(see golang/go#24043)
- Re-order assertions to remove looping and group by file

[#160911621]

Signed-off-by: Will Murphy <wmurphy@pivotal.io>
@golang golang locked and limited conversation to collaborators Apr 26, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Projects
None yet
Development

No branches or pull requests

4 participants