⬇ Download holy card: ·
Saint Zip Slip, Who Slipped Out of the Folder
Patron of compressed archives, paths with too many dots, and developers who extract without looking.
Life
On 5 June 2018 Snyk revealed that thousands of projects, Java ones above all, extracted ZIP, TAR and similar archives while blindly trusting the file names inside. An entry like ../../etc/something slipped out of the destination folder and overwrote whatever it liked, all the way to code execution. Apache Storm was among the many, and got the CVE.
Prayer
O Saint Zip Slip, who escapes every fence with two dots and a slash, let our extractors normalise their paths. Amen.
How to celebrate
Celebrated by checking that every extracted file stays inside the intended folder, and distrusting archives from strangers.
Dot, dot, slash: the archive makes a dash.