Potential fix for code scanning alert no. 4: Arbitrary file access during archive extraction ("Zip Slip")

[aramprice]

Note

Copilot generated fix

Potential fix for https://github.com/cloudfoundry/bosh-windows-stemcell-builder/security/code-scanning/4

To fix this safely, validate each archive entry name with explicit deny rules before using it in any filesystem operation. Keep existing behavior (flat archive only) but add strict checks for:

• empty names
• absolute paths
• any .. path segment (after normalization and slash unification)

Best targeted fix in stembuild/test/helpers/helpers.go inside extractArchive:

1. Right after name := h.Name, reject empty names.
2. Reject absolute paths with filepath.IsAbs(name).
3. Normalize separators (\ to /) and reject any path containing .. segment.
4. Keep the existing flat-archive check (filepath.Base(name) != name) to preserve intended functionality.

No new imports are needed; strings and filepath are already imported.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: fixing a Zip Slip vulnerability by validating archive entry names during extraction, which directly matches the code modifications.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description clearly relates to the changeset by explaining the security vulnerability fix (Zip Slip) and detailing the validation checks added to the extractArchive function.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch zip-fix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR addresses code scanning alert #4 (Zip Slip / arbitrary file access during archive extraction) by adding explicit validation of tar header names before extracting files in the test helper archive extractor.

Changes:

• Reject empty tar entry names.
• Reject absolute paths.
• Add a path traversal (.. segment) validation step before the existing “flat archive only” check.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@stembuild/test/helpers/helpers.go`:
- Around line 116-125: The path validation logic applies checks inconsistently
by normalizing backslashes to forward slashes only after performing
absolute-path and subdirectory checks on the raw name. Move the normalization
step (strings.ReplaceAll call that converts backslashes to forward slashes) to
the beginning of the validation logic, before the filepath.IsAbs check, and
apply all subsequent validations including the filepath.Base comparison to the
normalized path instead of the raw name. This ensures that backslash separators
are handled consistently across all checks, preventing entries like dir\file
from bypassing the subdirectory detection on Unix systems.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d327fb12-2fbc-4214-be52-6308616a44f1

📥 Commits

Reviewing files that changed from the base of the PR and between ed52eb7 and 461e565.

📒 Files selected for processing (1)

• stembuild/test/helpers/helpers.go

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.