Safe archive extraction: path traversal in zip and tar

What it is

CWE-22 describes path traversal: input that names a file escapes the intended directory via .. segments, absolute paths or links. Archives are a prime vector because they contain attacker-chosen file names, and naive extraction writes each entry to destination/<name> unchecked. Tar archives add symbolic and hard links that can point anywhere, and later entries can write through them.

Why it matters

An upload feature that extracts archives (themes, plugins, data imports) can overwrite configuration, cron entries or code on the server, turning a file upload into remote code execution.

How to apply

• For each entry, compute the resolved absolute target path and verify it starts with the resolved destination directory plus a separator; reject otherwise.
• Reject absolute names, names containing .. after normalisation, and device or special files.
• For tar, reject symlinks and hard links that resolve outside the destination, or reject links entirely unless needed.
• Enforce limits on entry count, uncompressed size and compression ratio to stop decompression bombs.
• Use the language's safe extraction filter where available (Python's tarfile extraction filters, for example) and keep the library current.
• Extract into a fresh temporary directory owned by an unprivileged user, then move into place.

Pitfalls

Checking with string prefixes without a trailing separator (/data/app matches /data/app-secrets). Case-insensitive or Unicode-normalising file systems that fold different names together. Trusting the archive's declared sizes.