rc-zip

rc-zip copied to clipboard

Is the library alive?

1

Hi! As far as I see, the library is not maintained anymore. @fasterthanlime do you still maintain this library? Because now the current library state is a little bit unclear....

zamazan4ik

This patch handles ZIP attacks such as **Zip Slip** (system path traversal), **Symlink Traversal**, and **absolute path write** (`/`) based on https://github.com/rust-compress/rc-zip/issues/17. Changes #### 1. `unwrap()` on `do_main()` panicked when...

mufeedvh

#13 found a dot-dot directory traversal vulnerability in the jean example program. The mitigation there of stripping `../` from paths is incomplete, and there are still other ways to escape...

l4AgXc

Error when compiling to `wasm32-unknown-unknown`: ``` Compiling rc-zip v0.0.1 error[E0277]: the trait bound `std::fs::File: ReadAt` is not satisfied --> /usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/rc-zip-0.0.1/src/reader/read_zip.rs:64:36 | 64 | ReadAt::read_zip_with_size(self, size) | ^^^^ the trait `ReadAt`...

dullbananas

Hi, I'm doing an "off the clock"/weekend project that I am _hoping_ will become commercial (but it's far from it right now) and I want to use rc-zip because it...

bivald

Please add link to one of these: - https://lib.rs/crates/rc-zip - https://crates.io/crates/rc-zip

89z

error management: avoid exposing types from dependencies from rc_zip::Error

4

instead of forcing errors to fit into `io::Error`, it would be easier to have a dedicated error enum that can hold a `io::Error`. As an example, see https://github.com/wyyerd/pulsar-rs/blob/master/client/src/error.rs It can...

Geal

Adding fuzz targets for all the functions that take byte slices is an easy way to assert that they don't panic unexpectedly. Even if it's unlikely to find buffer overflows...

killercup

avoiding the get_reader function argument

5

creating an `EntryReader` requires passing a function that takes an offset and returns an instance of `Read`: https://github.com/rust-compress/rc-zip/blob/69b884f85085c5c99a846703f83ddc48e0d086ac/src/format/archive.rs#L218 It happens because a `StoredEntry` has no access to the original data...

Geal

Support for extracting Apple's "endless" zip streams

1

I actually haven't tested your code to see if it already supports this, but since I just wrote something about Apple's special zip format (https://iosdev.space/@tempelorg/111993220533529890), I thought I'd look for...

tempelmann