Skip to content

Harden Windows archive path extraction#714

Merged
ryanfowler merged 1 commit into
mainfrom
harden-windows-archive-paths
Jun 4, 2026
Merged

Harden Windows archive path extraction#714
ryanfowler merged 1 commit into
mainfrom
harden-windows-archive-paths

Conversation

@ryanfowler

Copy link
Copy Markdown
Owner

Summary

  • Reject Windows alternate data stream syntax and reserved device names during archive extraction
  • Keep the existing traversal and drive-prefix checks in safe_archive_path
  • Add coverage for fetch.exe:ads, CON, and dir/NUL.txt

Testing

  • Unit tests updated for archive path validation
  • Existing Rust test suite remains the validation target for this change

@ryanfowler ryanfowler merged commit 6091395 into main Jun 4, 2026
4 checks passed
@ryanfowler ryanfowler deleted the harden-windows-archive-paths branch June 4, 2026 16:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant