{"record":{"id":"2b90f288d8fe5e9d","repo":"can1357/oh-my-pi","slug":"encrypted-zip-member-rawpath-is-not-supported","errorCode":null,"errorMessage":"Encrypted ZIP member '${rawPath}' is not supported","messagePattern":"Encrypted ZIP member '(.+?)' is not supported","errorType":"exception","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/zip.ts","lineNumber":503,"sourceCode":"\t\t\t{\n\t\t\t\tcompressedSize: compressedRaw,\n\t\t\t\tuncompressedSize: uncompressedRaw,\n\t\t\t\tlocalHeaderOffset: localOffsetRaw,\n\t\t\t\tdiskStart: diskStartRaw,\n\t\t\t},\n\t\t\t{\n\t\t\t\tcompressedSize: compressedRaw === U32_MAX,\n\t\t\t\tuncompressedSize: uncompressedRaw === U32_MAX,\n\t\t\t\tlocalHeaderOffset: localOffsetRaw === U32_MAX,\n\t\t\t\tdiskStart: diskStartRaw === U16_MAX,\n\t\t\t},\n\t\t);\n\t\tif (values.diskStart !== 0) throw new ArchiveError(\"Multi-volume ZIP archives are not supported\");\n\t\tconst rawPath =\n\t\t\textra.unicodePath ?? ((flags & UTF8_FLAG) !== 0 ? UTF8_DECODER : LEGACY_NAME_DECODER).decode(rawName);\n\t\tassertArchivePathString(rawPath, \"member path\", options.limits.maxPathBytes);\n\t\tif ((flags & (ENCRYPTED_FLAG | STRONG_ENCRYPTION_FLAG)) !== 0 || method === 99) {\n\t\t\tthrow new ArchiveError(`Encrypted ZIP member '${rawPath}' is not supported`);\n\t\t}\n\t\tconst normalizedPath = normalizeArchiveEntryPath(rawPath);\n\t\tif (normalizedPath) {\n\t\t\tassertArchiveMemberSize(\n\t\t\t\tMath.max(values.uncompressedSize, values.compressedSize),\n\t\t\t\tnormalizedPath,\n\t\t\t\toptions.limits,\n\t\t\t);\n\t\t\tconst host = versionMadeBy >>> 8;\n\t\t\tconst mode = host === UNIX_HOST || host === OSX_HOST ? externalAttributes >>> 16 : undefined;\n\t\t\tconst fileType = mode === undefined ? 0 : mode & FILE_TYPE_MASK;\n\t\t\tconst isDirectory =\n\t\t\t\tisArchiveDirectoryName(rawPath) || fileType === DIRECTORY_TYPE || (externalAttributes & 0x10) !== 0;\n\t\t\tconst isSymlink = fileType === SYMLINK_TYPE && !isDirectory;\n\t\t\tconst localHeaderOffset = values.localHeaderOffset + info.archiveOffset;\n\t\t\tcheckedEnd(localHeaderOffset, 30, source.size, `local header for '${normalizedPath}'`);\n\t\t\tconst member = new ZipMemberSource(\n\t\t\t\tsource,","sourceCodeStart":485,"sourceCodeEnd":521,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/zip.ts#L485-L521","documentation":"Thrown when a ZIP member's central-directory flags indicate encryption (bit 0 ENCRYPTED_FLAG or bit 6 STRONG_ENCRYPTION_FLAG) or the compression method is 99 (AES). The library does not implement decryption, so encrypted members cannot be read.","triggerScenarios":"Calling the ZIP reader on an archive created with a password (ZipCrypto or AES-256 via WinZip/7-Zip AES), where the member entry carries the encrypted bit or method 99.","commonSituations":"Receiving a password-protected ZIP from a colleague; CI pipelines fetching encrypted artifacts; backups exported with encryption enabled by default.","solutions":["Get the password and decrypt/extract the archive with an external tool (`unzip -P pass archive.zip` or `7z x -p<pass>`), then read the plain files","Ask the archive creator to provide an unencrypted ZIP","If you control creation, disable encryption when generating the archive","If password-protected input is a requirement, use a library that supports ZIP decryption"],"exampleFix":"// before: reading an encrypted zip directly\nconst entries = await readZip(Bun.file('secret.zip'));\n// after: decrypt externally first\nawait $`7z x -p${password} secret.zip -o./extracted`;\nconst entries = await readZip(Bun.file('extracted/plain.zip'));","handlingStrategy":"try-catch","validationCode":"const flagsView = new DataView(await Bun.file(zipPath).arrayBuffer());\n// heuristic: scan local header signatures and check general-purpose flag bit 0\nfor (let i = 0; i < flagsView.byteLength - 4; i++) {\n  if (flagsView.getUint32(i, true) === 0x04034b50 && (flagsView.getUint16(i + 6, true) & 1))\n    throw new Error('zip is password-protected');\n}","typeGuard":null,"tryCatchPattern":"try {\n  return await readZip(file);\n} catch (err) {\n  if (err instanceof ArchiveError && err.message.includes('Encrypted ZIP member')) {\n    throw new Error('Password-protected archive: decrypt externally with the password first', { cause: err });\n  }\n  throw err;\n}","preventionTips":["Ask for passwords/decrypted copies before automation","Create archives without encryption for CI use","Detect encrypted flag up front and surface a clear user-facing message"],"tags":["zip","encryption","unsupported-feature","security"],"backgroundTag":"encrypted-zip-unsupported","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}