Is fflate supposed to be able to read strange .zip files and guard against surprising behavior?

[thejoshwolfe]

I'm doing research on unzip implementations and I've found several odd behaviors in fflate that I would call bugs. I'm wondering if the maintainers of this project are interested in fixing corner case behavior or if the focus is really just on performance for the common case?

Here are a few examples of odd zipfiles that produce surprising behavior from the two unzip implementations in fflate:

confusing_1.zip
confusing_2.zip
dangerous_1.zip

That third one contains a path traversal vulnerability, which the maintainers of fflate might consider out of scope. I don't want to tell you how you should design your own software, but if you don't want to guard against this kind of thing, please document that so users know what they're signing up for.

Let me know if you'd like more info.

[101arrowz]

Thanks for the flag! I don't see any super concerning behavior here from a quick glance. fflate seems to get correct.txt properly from the first file using the sync API - are you referencing behavior with the streaming API or similar?

It gives nonsense output with an empty filename for the second one, but the file is not a valid ZIP per zipdetails - that might be worth changing, but the library makes no guarantees about throwing errors for "weird" ZIP files because there is a big difference between files that are compliant with the ZIP specification, and the kinds of "ZIP files" you actually encounter in the wild. fflate generally tries to handle misformatted ZIP files rather than throw errors as long to the extent possible. I agree that documentation could be added describing that design choice.

I do think the last case is out of scope and should not be described as a "path traversal vulnerability" because the library does not offer an API to write to disk for you. Anyone who chooses to use the library to write an "unzip" style tool that does write out to disk, and who doesn't want to extract outside the directory they choose, would probably want to do their own sanitization outside fflate. Again, I agree this would be worth documenting.

Unfortunately I haven't had time to maintain this project as regularly as I'd like for a while but I'll add some docs about this behavior in the next release. Thanks for the report!

[thejoshwolfe]

thanks for the reply! i will follow up with more details, but i'm taking some time to prepare.