vetkit.go.path-traversal.archive-extraction
An archive entry name is joined into the extraction path without checking that the result stays inside the destination (Zip Slip). An entry named ../../x is written outside the target directory.
Last updated:
Suite: Security
go
An archive entry name is joined into the extraction path without checking that the result stays inside the destination (Zip Slip). An entry named ../../x is written outside the target directory.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
After filepath.Join, reject the entry unless the cleaned path keeps the destination prefix (strings.HasPrefix(p, filepath.Clean(dest)+string(os.PathSeparator))) or filepath.IsLocal(name) holds.
References
Source: packages/engine/rules/sast/go.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.