{"record":{"id":"d7576fb11fe72130","repo":"diegosouzapw/OmniRoute","slug":"zip-entry-basename-has-an-unsafe-filename-mu","errorCode":null,"errorMessage":"ZIP entry \"${baseName}\" has an unsafe filename (must be a .json file without path traversal)","messagePattern":"ZIP entry \"(.+?)\" has an unsafe filename \\(must be a \\.json file without path traversal\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/utils/jsonZipExtract.ts","lineNumber":62,"sourceCode":"\n  if (jsonEntries.length === 0) {\n    throw new Error(\"ZIP archive contains no .json files\");\n  }\n\n  if (jsonEntries.length > maxFiles) {\n    throw new Error(\n      `ZIP archive contains ${jsonEntries.length} .json files — max allowed is ${maxFiles}`\n    );\n  }\n\n  let totalBytes = 0;\n  const result: ExtractedZipFile[] = [];\n\n  for (const [entryName, data] of jsonEntries) {\n    const baseName = path.basename(entryName);\n\n    if (!isSafeEntryName(baseName)) {\n      throw new Error(\n        `ZIP entry \"${baseName}\" has an unsafe filename (must be a .json file without path traversal)`\n      );\n    }\n\n    if (!isSafeEntryName(entryName)) {\n      throw new Error(\n        `ZIP entry path \"${entryName}\" is unsafe (no \"..\", absolute paths, or control characters allowed)`\n      );\n    }\n\n    if (data.byteLength > maxFileSize) {\n      throw new Error(\n        `ZIP entry \"${baseName}\" is ${data.byteLength} bytes — exceeds ${maxFileSize} byte limit per file`\n      );\n    }\n\n    totalBytes += data.byteLength;\n    if (totalBytes > maxTotal) {","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/oauth/utils/jsonZipExtract.ts#L44-L80","documentation":"Error \"ZIP entry \"${baseName}\" has an unsafe filename (must be a .json file without path traversal)\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/oauth/utils/jsonZipExtract.ts:62 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}