{"record":{"id":"ec6a961363771e31","repo":"anomalyco/sst","slug":"illegal-file-path-in-zip-s","errorCode":null,"errorMessage":"illegal file path in zip: %s","messagePattern":"illegal file path in zip: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/runtime/python/build.go","lineNumber":361,"sourceCode":"\t// Remove the original archive\n\tos.Remove(archiveFile)\n\n\treturn nil\n}\n\n// extractZip extracts a zip archive (used for .whl files) to the destination directory.\nfunc extractZip(archiveFile, destDir string) error {\n\tr, err := zip.OpenReader(archiveFile)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open zip: %w\", err)\n\t}\n\tdefer r.Close()\n\n\tfor _, f := range r.File {\n\t\t// Guard against zip slip\n\t\ttarget := filepath.Join(destDir, f.Name)\n\t\tif !strings.HasPrefix(filepath.Clean(target), filepath.Clean(destDir)+string(os.PathSeparator)) {\n\t\t\treturn fmt.Errorf(\"illegal file path in zip: %s\", f.Name)\n\t\t}\n\n\t\tif f.FileInfo().IsDir() {\n\t\t\tif err := os.MkdirAll(target, 0755); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\n\t\tif err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\trc, err := f.Open()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/runtime/python/build.go#L343-L379","documentation":"`extractZip` guards against zip-slip attacks: each entry's target path must stay inside `destDir`. If a wheel contains an entry whose normalized path escapes the destination (absolute path or `../` traversal), extraction is aborted with this error.","triggerScenarios":"Extracting a .whl that contains entries with names like `../../evil.py`, `/absolute/path`, or drive-absolute paths, so `filepath.Clean(target)` no longer has `destDir` as prefix.","commonSituations":"A tampered or malicious package downloaded from an untrusted index; a hand-crafted wheel placed in the build dir; rare pathological filenames from a broken build tool.","solutions":["Do not install wheels from untrusted indexes — pin to official PyPI with hash checking (`--require-hashes` in requirements)","Delete the offending wheel and rebuild from a trusted source","Audit the package name in `install`; verify you did not typo into a typosquatting package","Inspect the wheel contents (`unzip -l <file>.whl`) to confirm the malicious paths before reporting the package"],"exampleFix":"// before\ninstall: [\"requesfs\"] // typosquat wheel with ../../ paths\n// after\ninstall: [\"requests\"] // trusted package from official PyPI","handlingStrategy":"try-catch","validationCode":"import { readFileSync, unzipSync } from \"zlib\"; // or use yauzl\n// Pre-scan entry names with a zip lib and reject any containing '..' or leading '/':\n// for (const name of entryNames) if (name.startsWith(\"/\") || name.includes(\"../\")) throw ...","typeGuard":null,"tryCatchPattern":"try {\n  await buildPackage(...);\n} catch (e) {\n  if (String(e).includes(\"illegal file path in zip\")) {\n    console.error(\"Malicious/pathological wheel rejected — remove package and audit sources:\", e);\n  }\n  throw e;\n}","preventionTips":["Install only from trusted indexes (official PyPI)","Use hash pinning (`--require-hashes`) for dependencies","Watch for typosquatting in package names","Never place hand-crafted wheels in the build directory"],"tags":["python","security","zip-slip","wheel"],"backgroundTag":"zip-slip-path-traversal","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}