Repair Archive & Extraction Bugs

I have analyzed the extraction logic and identified the missing path normalization and symlink validation steps. I have implemented a bounded repair that enforces the /tmp/app/data root invariant.

Secure Extraction Repair

const admZip = require('adm-zip');
const path = require('path');
const fs = require('fs');

function secureExtract(zipPath, targetDir) {
  const zip = new admZip(zipPath);
  const resolvedTarget = path.resolve(targetDir);

  zip.getEntries().forEach((entry) => {
    // 1. Path Traversal Protection (Zip-Slip)
    const entryPath = entry.entryName;
    const fullPath = path.resolve(resolvedTarget, entryPath);
    
    if (!fullPath.startsWith(resolvedTarget)) {
      throw new Error(`Security Alert: Blocked path traversal attempt in ${entryPath}`);
    }

    // 2. Symlink Policy Enforcement
    if (entry.isSymbolicLink) {
      // In this repair, we block symlinks to prevent arbitrary read/write via link targets
      console.warn(`Skipping symlink: ${entryPath}`);
      return;
    }

    // 3. Directory Creation and Extraction
    if (entry.isDirectory) {
      fs.mkdirSync(fullPath, { recursive: true });
    } else {
      const mode = entry.attr >>> 16 & 0xFFF; // Preserve permissions safely
      zip.extractEntryTo(entry, resolvedTarget, false, true);
      fs.chmodSync(fullPath, mode || 0o644);
    }
  });
}

Next steps

1. Verify Root Path: Ensure the runtime user has write permissions specifically to /tmp/app/data.

Integration Test: Run the provided implementation against a test archive containing ../ sequences to confirm the traversal block.
3.

Resource Limits: If handling large archives, consider migrating this logic to unzipper with a stream-based buffer to avoid memory exhaustion.