hunting-unsafe-archive-extractionlisted

# Hunting unsafe archive extraction: when unpacking a file writes outside the box Extracting an archive feels like a read, but it is a series of attacker-directed writes. Each entry carries a name, sometimes a link target, and a declared size, and a naive extractor trusts all three: it joins the name to the destination and writes, follows a link, and allocates whatever the entry claims. A crafted archive uses that trust to write outside the destination with a traversal path or a symlink, to overwrite a file that matters, or to expand a few kilobytes into enough data to exhaust disk or memory. You find these by tracing each entry's path, link, and size to the write it drives and asking what confirms the write stays inside and stays bounded. ## When to use - Code extracts a user-supplied or externally fetched archive to disk (import, restore, install, upload). - Entry paths, symlinks, or declared sizes from the archive are trusted while writing. - A written file is later executed, served, loaded, or read back as configuration. ## Scope check Unpack crafted archives only into systems and paths you own or are authorized to test, and in a sandbox where a write outside the destination cannot damage anything real. A path-escape proof can overwrite live files. If you can't name the authorization, stop. ## The loop 1. **Map where untrusted archives are extracted.** Inventory the code paths that unpack a compressed archive whose contents come from a user or a remote source. N