Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ZipStorer.cs - Security and Compatibility Issues and Fixes #53

Open
EJocys opened this issue Aug 18, 2024 · 1 comment
Open

ZipStorer.cs - Security and Compatibility Issues and Fixes #53

EJocys opened this issue Aug 18, 2024 · 1 comment

Comments

@EJocys
Copy link

EJocys commented Aug 18, 2024

Security Issue

Problem: Insecure temporary file creation methods should not be used.

var tempZipName = Path.GetTempFileName();
var tempEntryName = Path.GetTempFileName();

Solution:

var tempFolderPath = Path.GetTempPath();
var tempZipName = Path.Combine(tempFolderPath, Path.GetRandomFileName());
var tempEntryName = Path.Combine(tempFolderPath, Path.GetRandomFileName());

.NET 4.8 Compatibility issue

Problem: CodePagesEncodingProvider is not available in .NET 4.8

	CodePagesEncodingProvider.Instance.GetEncoding(437);
	Encoding.RegisterProvider(CodePagesEncodingProvider.Instance);
	DefaultEncoding = Encoding.GetEncoding(437);

Solution: Use condition to exclude code for .NET 48 build:

#if NET5_0_OR_GREATER
	CodePagesEncodingProvider.Instance.GetEncoding(437);
	Encoding.RegisterProvider(CodePagesEncodingProvider.Instance);
#endif
	DefaultEncoding = Encoding.GetEncoding(437);
@jaime-olivares
Copy link
Owner

jaime-olivares commented Aug 22, 2024

Please see my comment in #52 regarding CP 437
I will incorporate your suggestion about temporary files once the previous is resolved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants