anomalyco/sst · critical

illegal file path in zip: %s

Error message

illegal file path in zip: %s

What it means

`extractZip` guards against zip-slip attacks: each entry's target path must stay inside `destDir`. If a wheel contains an entry whose normalized path escapes the destination (absolute path or `../` traversal), extraction is aborted with this error.

Source

Thrown at pkg/runtime/python/build.go:361

	// Remove the original archive
	os.Remove(archiveFile)

	return nil
}

// extractZip extracts a zip archive (used for .whl files) to the destination directory.
func extractZip(archiveFile, destDir string) error {
	r, err := zip.OpenReader(archiveFile)
	if err != nil {
		return fmt.Errorf("failed to open zip: %w", err)
	}
	defer r.Close()

	for _, f := range r.File {
		// Guard against zip slip
		target := filepath.Join(destDir, f.Name)
		if !strings.HasPrefix(filepath.Clean(target), filepath.Clean(destDir)+string(os.PathSeparator)) {
			return fmt.Errorf("illegal file path in zip: %s", f.Name)
		}

		if f.FileInfo().IsDir() {
			if err := os.MkdirAll(target, 0755); err != nil {
				return err
			}
			continue
		}

		if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
			return err
		}

		rc, err := f.Open()
		if err != nil {
			return err
		}

View on GitHub (pinned to a0bd20f762)

Solutions

1. Do not install wheels from untrusted indexes — pin to official PyPI with hash checking (`--require-hashes` in requirements)
2. Delete the offending wheel and rebuild from a trusted source
3. Audit the package name in `install`; verify you did not typo into a typosquatting package
4. Inspect the wheel contents (`unzip -l <file>.whl`) to confirm the malicious paths before reporting the package

Example fix

// before
install: ["requesfs"] // typosquat wheel with ../../ paths
// after
install: ["requests"] // trusted package from official PyPI

import { readFileSync, unzipSync } from "zlib"; // or use yauzl
// Pre-scan entry names with a zip lib and reject any containing '..' or leading '/':
// for (const name of entryNames) if (name.startsWith("/") || name.includes("../")) throw ...

try {
  await buildPackage(...);
} catch (e) {
  if (String(e).includes("illegal file path in zip")) {
    console.error("Malicious/pathological wheel rejected — remove package and audit sources:", e);
  }
  throw e;
}

When it happens

Trigger: Extracting a .whl that contains entries with names like `../../evil.py`, `/absolute/path`, or drive-absolute paths, so `filepath.Clean(target)` no longer has `destDir` as prefix.

Common situations: A tampered or malicious package downloaded from an untrusted index; a hand-crafted wheel placed in the build dir; rare pathological filenames from a broken build tool.

Related errors

• failed to extract wheel: %w
• failed to open zip: %w
• redirect_uri mismatch
• client_id mismatch
• default Python Dockerfile not found at %s: %w

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/ec6a961363771e31. Report an issue: GitHub.