microsoft/aspire · error · InvalidOperationException

Zip entry ' ' would extract outside the destination…

Error message

Zip entry '{entry.FullName}' would extract outside the destination directory.

What it means

ExtractZipSafe validates every zip entry's resolved full path against the normalized destination directory and throws InvalidOperationException if the entry would land outside it. This blocks zip-slip path traversal attacks via entries containing '..' segments or absolute paths.

Solutions

1. Obtain the archive from a trusted source and re-download/verify it.
2. Inspect entry names (e.g. with a zip listing tool) and repack entries with relative, in-bounds paths.
3. If this is your own packaging pipeline, fix the tool that produced entries with absolute or '..' paths.

Example fix

// before
// entry: "../../outside.dll"
// after
// repack so all entries are relative and inside the archive root: "lib/outside.dll"

using var archive = ZipFile.OpenRead(archivePath);
var destFull = Path.GetFullPath(destinationPath);
var unsafeEntry = archive.Entries.FirstOrDefault(e =>
    !Path.GetFullPath(Path.Combine(destFull, e.FullName)).StartsWith(destFull + Path.DirectorySeparatorChar, StringComparison.Ordinal));

try { await ArchiveHelper.ExtractAsync(zipPath, dest, env, ct); }
catch (InvalidOperationException ex) when (ex.Message.Contains("would extract outside")) { // reject untrusted archive, log entry name
}

When it happens

Trigger: Extracting a zip whose entry FullName resolves outside the destination after Path.GetFullPath(Path.Combine(destination, entry.FullName)) — e.g. entry names like '../../evil.exe' or absolute paths.

Common situations: A malicious or corrupted archive from an untrusted source; a legitimately mis-packaged archive with '..' entry names; testing the security guard with crafted archives.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Tar entry ' ' would extract outside the destination…
• Tar entry ' ' would extract outside the destination…
• Aspire skills archive entry
• Aspire skills archive entry
• Aspire skills bundle path

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/6fec75e79f52a263. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Cli/Utils/ArchiveHelper.cs:52

    }

    private static void ExtractZipSafe(string archivePath, string destinationPath)
    {
        var normalizedDestination = Path.GetFullPath(destinationPath);

        using var archive = ZipFile.OpenRead(archivePath);
        foreach (var entry in archive.Entries)
        {
            if (string.IsNullOrEmpty(entry.FullName))
            {
                continue;
            }

            var fullPath = Path.GetFullPath(Path.Combine(destinationPath, entry.FullName));
            if (!fullPath.StartsWith(normalizedDestination + Path.DirectorySeparatorChar, StringComparison.Ordinal) &&
                !fullPath.Equals(normalizedDestination, StringComparison.Ordinal))
            {
                throw new InvalidOperationException($"Zip entry '{entry.FullName}' would extract outside the destination directory.");
            }

            if (entry.FullName.EndsWith('/') || entry.FullName.EndsWith('\\'))
            {
                Directory.CreateDirectory(fullPath);
            }
            else
            {
                var dir = Path.GetDirectoryName(fullPath);
                if (dir is not null)
                {
                    Directory.CreateDirectory(dir);
                }
                entry.ExtractToFile(fullPath, overwrite: true);
            }
        }
    }

View on GitHub (pinned to 25830f84bd)