| 493 | # ------------------------------------------------------------------ |
| 494 | |
| 495 | def check_zip_traversal(self) -> list: |
| 496 | checks = [ |
| 497 | { |
| 498 | "id": "ZIP_PATH_TRAVERSAL", |
| 499 | "title": "Potential Zip Path Traversal (Zip Slip)", |
| 500 | "severity": "HIGH", |
| 501 | "owasp": "M4: Insufficient Input/Output Validation", |
| 502 | "description": ( |
| 503 | "ZipEntry.getName() returns the entry path as stored in the archive. " |
| 504 | "If this path is used to write files without canonicalisation and " |
| 505 | "containment checks (e.g., startsWith(destDir)), an attacker can " |
| 506 | "craft a ZIP file with '../' entries to overwrite arbitrary files." |
| 507 | ), |
| 508 | "pattern": r'ZipEntry.*getName\s*\(\s*\)|ZipInputStream|new\s+ZipFile\s*\(', |
| 509 | }, |
| 510 | ] |
| 511 | return self._scan_pattern(checks) |
| 512 | |
| 513 | # ------------------------------------------------------------------ |
| 514 | # Internal helpers |