Skip to content

archive/zip: produces incorrect zip archives #30627

Description

@enchobelezirev

What version of Go are you using (go version)?

$ go version
go version go1.11.5 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
windows

What did you do?

I am using the archive/zip library in order to produce a zip archive from a given directory. In that directory I have nested directory structures. The problem comes when I build the archive, I am walking each element in the given directory and am I writing it to the zip archive. If the currently walking path element is a dir, I just add a os.PathSeparator to the header's Name.
When the build is finished and I start to read the zip, I see that the files which are read contain "\" - backslashes - default PathSeparator for Windows. As the ZIP Spec defines, each path separator in the ZIP should be a '/' - leading slash.

I saw that description in the FileHeader struct:

// It must be a relative path, not start with a drive letter (such as "C:"),
// and must use forward slashes instead of back slashes. A trailing slash
// indicates that this file is a directory and should have no data.
//
// When reading zip files, the Name field is populated from
// the zip file directly and is not validated for correctness.
// It is the caller's responsibility to sanitize it as
// appropriate, including canonicalizing slash directions,
// validating that paths are relative, and preventing path
// traversal through filenames ("../../../").

In my opinion, the library should take care of \\ - back slashes not the developer of the code :)
Tell me what do you think about this.
Do you accept PRs and fixes about such small changes?

What did you expect to see?

A zip archive containing only '/' as path separators

What did you see instead?

On windows I see the following path separators '\'

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FrozenDueToAgeNeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions