False Positive - cs/zipslip

[ropwareJB]

Fixes false positive whereby there is a barrier that correctly sanitizes the path and throws on failure:

        /**
        * Negative - no extraction, only sanitization
        */
        static void fp_throw_sanitizer_valid(string file, string root){
            string destinationOnDisk = Path.GetFullPath(file);
            string fullRoot = Path.GetFullPath(root + Path.DirectorySeparatorChar);
            if (!destinationOnDisk.StartsWith(fullRoot)){
                throw new Exception("Entry is outside of target directory. There may have been some directory traversal sequences in filename.");
            }
        }

        /**
        * Negative - dangerous path terminates early due to throw in fp_throw_sanitizer_valid
        */
        static void fp_throw_nested_exception_uncaught(ZipArchive archive, string root){
            foreach (var entry in archive.Entries){
                string destinationOnDisk = Path.GetFullPath(Path.Combine(root, entry.FullName));
                string fullRoot = Path.GetFullPath(root + Path.DirectorySeparatorChar);
                fp_throw_sanitizer_valid(destinationOnDisk, fullRoot);
                entry.ExtractToFile(destinationOnDisk, true);
            }
        }

[MathiasVP]

The changes LGTM! Should we do a DCA run on it as well?

[ropwareJB]

The changes LGTM! Should we do a DCA run on it as well?

We can run DCA on it with the PR on the main repository, but there is a known performance issue with this query already that I could use some pointers on. This PR at least satisfies the false positives that have been submitted, and I was going to follow on with a subsequent PR addressing performance