no-zip-slip

CWE: CWE-693
OWASP Mobile: OWASP Mobile Top 10

Detects zip slip/archive extraction vulnerabilities. This rule is part of eslint-plugin-node-security.

💼 This rule is set to error in the recommended config.

Quick SummaryCopy Anchor Link

Vulnerability and RiskCopy Anchor Link

Vulnerability: Zip Slip is a form of directory traversal vulnerability that occurs during archive extraction. It allows an attacker to create files outside of the intended extraction directory by including directory traversal characters (e.g., ../) in the filenames within the archive.

Risk: An attacker can overwrite critical system files, configuration files, or application source code. This can lead to Remote Code Execution (RCE) if they overwrite an executable or a file that the application loads.

Rule DetailsCopy Anchor Link

Zip slip vulnerabilities occur when extracting archives without properly validating file paths. Attackers can include files with path traversal sequences like ../ to write files outside the intended extraction directory, potentially:

• Overwrite critical system files
• Plant backdoors or web shells
• Replace application binaries
• Modify configuration files

Why This MattersCopy Anchor Link

ExamplesCopy Anchor Link

❌ IncorrectCopy Anchor Link

// Extracting without path validation
const zip = new AdmZip(uploadedFile);
zip.extractAllTo(targetDir); // Vulnerable!

// Using entry path directly
for (const entry of archive.entries()) {
  const outputPath = path.join(targetDir, entry.name);
  fs.writeFileSync(outputPath, entry.getData()); // Vulnerable!
}

// tar extraction without validation
tar.extract({ file: uploadedTar, cwd: targetDir });

✅ CorrectCopy Anchor Link

const safeExtract = require('safe-archive-extract');
safeExtract(file, dest);

// Resolve, check containment, then use the checked path
for (const entry of archive.entries()) {
  const outputPath = path.resolve(targetDir, entry.name);
  if (!outputPath.startsWith(targetDir + path.sep)) {
    throw new Error(`Zip Slip: ${entry.name}`);
  }
  fs.writeFileSync(outputPath, entry.getData());
}

// The path.relative() spelling of the same check
const rel = path.relative(targetDir, outputPath);
if (rel.startsWith('..') || path.isAbsolute(rel)) continue;

A check validates only the branch where it passed. A join written in the branch where it failed — if (!p.startsWith(dest)) { write(path.join(dest, entry.name)) } — is still reported.

@safeCopy Anchor Link

An @safe comment — block (/** @safe */) or line (// @safe) — covers the statement directly below it, and everything inside that statement (so one on a function covers the function). It does not cover the rest of the file: a /** @safe */ in a file header vouches for the first statement only.

// @safe — entries were verified by the upload service
zip.extractAllTo(dest);

ConfigurationCopy Anchor Link

{
  rules: {
    'node-security/no-zip-slip': ['error', {
      archiveFunctions: ['extract', 'extractAll', 'extractAllTo', 'unzip'],
      pathValidationFunctions: ['validatePath', 'isWithinDirectory'],
      safeLibraries: ['safe-archive', 'secure-unzip']
    }]
  }
}

OptionsCopy Anchor Link

Error Message FormatCopy Anchor Link

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-22 OWASP:A01 CVSS:7.5 | Path Traversal detected | HIGH [SOC2,PCI-DSS,HIPAA,ISO27001]
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A01_2021/

Message ComponentsCopy Anchor Link

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Values from VariablesCopy Anchor Link

Why: Values stored in variables are not traced.

// ❌ NOT DETECTED - Value from variable
const value = userInput;
dangerousOperation(value);

Mitigation: Validate all user inputs.

Wrapper FunctionsCopy Anchor Link

Why: Custom wrappers not recognized.

// ❌ NOT DETECTED - Wrapper
myWrapper(userInput); // Uses dangerous API internally

Mitigation: Apply rule to wrapper implementations.

Dynamic InvocationCopy Anchor Link

Why: Dynamic calls not analyzed.

// ❌ NOT DETECTED - Dynamic
obj[method](userInput);

Mitigation: Avoid dynamic method invocation.

Further ReadingCopy Anchor Link

• Snyk Zip Slip Research - Original research
• CWE-22 - Path traversal documentation
• OWASP Path Traversal - Attack techniques

Related RulesCopy Anchor Link

• detect-non-literal-fs-filename - Path traversal in fs operations
• no-toctou-vulnerability - Race condition vulnerabilities

Use this rule

npm install -D oxlint-plugin-node-security

{  "jsPlugins": ["oxlint-plugin-node-security"],  "rules": {    "node-security/no-zip-slip": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-node-security'],    rules: {      'node-security/no-zip-slip': 'error',    },  },});