Harden zip extraction against member names Windows cannot write - #389
Merged
Conversation
Port of iLEAPP commit 5ee6a09e, which fixed errors surfaced by a Windows run over an iOS 26 extraction; the failing code path is shared across the LEAPP family. FileSeekerZip: zip members whose names carry ASCII control characters failed to write on Windows with EINVAL and the failing member appended the previous member's stale path to the result list. Such members are now written manually to a sanitized path inside the data folder on every platform, and sanitize_file_path/sanitize_file_name treat control characters (0x00-0x1F, 0x7F) as illegal. Regression coverage: 11 tests, synthetic zips only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port of iLEAPP commit 5ee6a09e (PR #1879). The failing code path is shared across the LEAPP family.
FileSeekerZip: members with control characters in their names
ZipFile.extract()only replaces a fixed set of printable characters (:<>|"?*) and only on Windows, so ASCII control characters in a member name (observed in a real iOS 26 extraction: chronod icon files likeƬ\x01\x0e::com.apple.siri.heic) reach the OS untouched and Windows rejects them with EINVAL. The member then silently went missing from the extraction, and worse, the failing member appended the previous member's staleextracted_pathto the seeker's result list. Such members are now written manually to a sanitized path inside the data folder on every platform, andsanitize_file_path/sanitize_file_nametreat control characters (0x00-0x1F, 0x7F) as illegal.Tests
11 new tests in
admin/test/scripts/test_extraction_illegal_filenames.py(synthetic zips only, no image data), including a path-traversal guard for the manual extraction path.🤖 Generated with Claude Code