Description

This vulnerability detector identifies Rust code susceptible to Zip Slip (Path Traversal) attacks through ZIP archive extraction. It finds instances where ZIP entry names containing malicious path traversal sequences (e.g., "../../../etc/passwd") are used in file write operations without proper validation, allowing attackers to overwrite arbitrary files outside the intended extraction directory.

Detection Strategy

• The detector first checks if the ZIP library is imported with a prefix starting with 'zip' in the analyzed file

• It then examines selected code nodes to identify file write operations (file creation, writing, or copying)

• The detector specifically looks for write operations that use ZIP entry names as part of the file path

• A vulnerability is reported when ZIP entry names are directly used in file write operations without validation to prevent path traversal sequences like '../' that could escape the intended directory

Vulnerable code example

use std::fs::File;
use std::io;
use std::path::Path;
use zip::ZipArchive;

fn extract_zip(archive_path: &str) {
    let reader = File::open(archive_path).unwrap();
    let mut archive = ZipArchive::new(reader).unwrap();...

✅ Secure code example

use std::fs::File;
use std::io;
use std::path::Path;
use zip::ZipArchive;

fn extract_zip(archive_path: &str) {
    let reader = File::open(archive_path).unwrap();
    let mut archive = ZipArchive::new(reader).unwrap();...