New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
archive/zip: don't read directories containing file data #54801
Comments
May I take this up? |
Sure, go for it! |
@neild Is it possible to for you to share the zip file to reproduce the issue? |
Change https://go.dev/cl/449955 mentions this issue: |
Change https://go.dev/cl/450280 mentions this issue: |
For #48866 For #54139 For #54801 Change-Id: Iafe72ccc7e756ec1edb5bb7e8e90d385458cff29 Reviewed-on: https://go-review.googlesource.com/c/go/+/450280 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
It seems that the Java
(Note the size 2 on I don't know how common it is to process JAR files with Go, but everyone who does will need to make a code change. Is that okay? Seems worth updating the release notes, and maybe we should add a Reopening to track as a release blocker, but okay after RC1. |
http://go.dev/cl/454475 and http://go.dev/cl/455523 should've been attached to this issue, I believe. @rolandshoemaker please confirm it's fixed? |
Ah yes, sorry, didn't realize this got reopened. This should be fixed (slightly more lenient) now. |
(We've also sent an upstream patch to OpenJDK which fixes the |
For reference, openjdk/jdk#11441. |
The
archive/zip
package forbids writing data to directory files: Writing to theio.Writer
returned byw.Create("dir/")
fails withzip: write to directory
.However,
archive/zip
permits reading data from directory files. This means there are zip archives that can be read byarchive/zip
, but not rewritten. In addition, the zip specification doesn't permit directories to contain file data, so these archives are invalid:We should return an error when parsing a zip file that contains a directory that contains data.
Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for the report.
The text was updated successfully, but these errors were encountered: