security: sanitize filenames used in multi-file zip uploads (ai:gpt-5) #51

New issue

Closed

opened 2026-05-23 22:09:04 +02:00 by heiko · 0 comments

heiko commented

2026-05-23 22:09:04 +02:00

Owner

Finding from a whole-codebase security review.

Affected code:

cmd/once-server/upload.go:163-181 creates zip entries from filepath.Join(basename, f.Filename).

Impact:
Multipart filenames are client-controlled. A filename containing path traversal, an absolute path, or platform-specific separators can become a dangerous zip entry name. Recipients who extract the generated archive with vulnerable tooling may write files outside the intended extraction directory. Single-file uploads use filepath.Base; the multi-file zip path does not.

Suggested fix:

Sanitize each zip entry name before zipW.CreateHeader.
Use portable slash-separated zip names, reject absolute paths, drive letters, empty names, and any . or .. segment.
Consider flattening to filepath.Base unless preserving directories is an explicit feature.
Add tests with filenames like ../secret, /tmp/secret, a/../../secret, and Windows-style paths.

Finding from a whole-codebase security review. Affected code: - cmd/once-server/upload.go:163-181 creates zip entries from `filepath.Join(basename, f.Filename)`. Impact: Multipart filenames are client-controlled. A filename containing path traversal, an absolute path, or platform-specific separators can become a dangerous zip entry name. Recipients who extract the generated archive with vulnerable tooling may write files outside the intended extraction directory. Single-file uploads use `filepath.Base`; the multi-file zip path does not. Suggested fix: - Sanitize each zip entry name before `zipW.CreateHeader`. - Use portable slash-separated zip names, reject absolute paths, drive letters, empty names, and any `.` or `..` segment. - Consider flattening to `filepath.Base` unless preserving directories is an explicit feature. - Add tests with filenames like `../secret`, `/tmp/secret`, `a/../../secret`, and Windows-style paths.

heiko added the

security

label

2026-05-24 18:44:09 +02:00

heiko referenced this issue from a commit

2026-05-24 20:36:04 +02:00

security: sanitize filenames in multi-file zip uploads (fixes #51) ai:claude-sonnet-4-5

heiko referenced this issue from a commit

2026-05-24 20:43:23 +02:00

Merge branch 'fix/51-zip-slip' into security/all-fixes

heiko referenced this issue from a commit

2026-05-24 20:43:23 +02:00