[BUG] Zip symlink detection may fail on Windows-created archives (cross-platform issue) #34

New issue

Closed

opened 2026-05-08 23:51:47 +00:00 by Mark · 2 comments

Mark commented

2026-05-08 23:51:47 +00:00

Owner

Problem

In launcher/validation/AppValidator.js, symlink detection in zip entries relies on Unix external attributes:

const unixFileTypeMask = 0o170000;
const unixSymlinkType = 0o120000;
const isSymlink = ((entry.header.attr >>> 16) & unixFileTypeMask) === unixSymlinkType;

This only works when the zip was created with Unix-style metadata. Zips created on Windows or by some tools may not have these attributes, allowing symlink entries to pass undetected.

Impact

A symlink pointing outside the extraction directory (e.g., to ../.launcher/auth/) could bypass path traversal protections if the Unix attribute check fails.

Suggestion

Add secondary detection or apply path traversal checks after extraction regardless of entry type.

File

launcher/validation/AppValidator.js:189-193

## Problem In `launcher/validation/AppValidator.js`, symlink detection in zip entries relies on Unix external attributes: ```javascript const unixFileTypeMask = 0o170000; const unixSymlinkType = 0o120000; const isSymlink = ((entry.header.attr >>> 16) & unixFileTypeMask) === unixSymlinkType; ``` This only works when the zip was created with Unix-style metadata. Zips created on Windows or by some tools may not have these attributes, allowing symlink entries to pass undetected. ## Impact A symlink pointing outside the extraction directory (e.g., to `../.launcher/auth/`) could bypass path traversal protections if the Unix attribute check fails. ## Suggestion Add secondary detection or apply path traversal checks after extraction regardless of entry type. ## File `launcher/validation/AppValidator.js:189-193`