Files
codeql/go/ql/test/query-tests/Security/CWE-022/ZipSlip.go
2022-05-20 10:07:19 -07:00

17 lines
291 B
Go

package main
import (
"archive/zip"
"io/ioutil"
"path/filepath"
)
func unzip(f string) {
r, _ := zip.OpenReader(f)
for _, f := range r.File {
p, _ := filepath.Abs(f.Name)
// BAD: This could overwrite any file on the file system
ioutil.WriteFile(p, []byte("present"), 0666)
}
}