From d0b8939d74af16f0b6c6f75225af4f3a7fd24745 Mon Sep 17 00:00:00 2001 From: Radek Zikmund Date: Mon, 17 Aug 2026 11:11:56 +0200 Subject: [PATCH 1/3] Add reference to best practices document --- includes/tar-zip-extracttodirectory.md | 2 ++ xml/System.IO.Compression/ZipFile.xml | 50 +++++++++----------------- 2 files changed, 19 insertions(+), 33 deletions(-) create mode 100644 includes/tar-zip-extracttodirectory.md diff --git a/includes/tar-zip-extracttodirectory.md b/includes/tar-zip-extracttodirectory.md new file mode 100644 index 00000000000..bf107250e92 --- /dev/null +++ b/includes/tar-zip-extracttodirectory.md @@ -0,0 +1,2 @@ +> [!WARNING] +> This method must be used only on trusted archives as it doesn't enforce any size limits, entry count limits, or other policies needed for safe extraction of untrusted archives. Refer to [Best practices for using zip and tar archives](dotnet/standard/io/zip-tar-best-practices) for more information on safely extracting archives from untrusted sources. diff --git a/xml/System.IO.Compression/ZipFile.xml b/xml/System.IO.Compression/ZipFile.xml index ae46cc12680..498acfda957 100644 --- a/xml/System.IO.Compression/ZipFile.xml +++ b/xml/System.IO.Compression/ZipFile.xml @@ -1156,8 +1156,7 @@ An I/O error occurred while opening a file to be archived. If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1235,8 +1234,7 @@ An archive entry was compressed by using a compression method that isn't support If an entry in the zip archive is a symbolic link, it's extracted as a regular folder since symbolic link information isn't preserved in the ZIP format. If `destinationDirectoryName` or any of its parent directories is a pre-existing junction or symbolic link, the link is followed and the extraction writes to the final target folder. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ## Examples This example shows how to create and extract a zip archive by using the class. It compresses the contents of a folder into a zip archive and extracts that content to a new folder. To use the class, you must reference the `System.IO.Compression.FileSystem` assembly in your project. @@ -1321,8 +1319,7 @@ An archive entry was compressed by using a compression method that isn't support If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1433,8 +1430,7 @@ An archive entry was compressed by using a compression method that isn't support If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1520,8 +1516,7 @@ If `destinationDirectoryName` or any of its parent directories is a pre-existing If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1662,9 +1657,8 @@ If `entryNameEncoding` is set to `null`, entry names and comments are decoded ac - For entries where the language encoding flag (in the general-purpose bit flag of the local file header) is not set, entry names and comments are decoded by using the current system default code page. - For entries where the language encoding flag is set, the entry names and comments are decoded by using UTF-8. - -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. + +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1755,8 +1749,7 @@ If `entryNameEncoding` is set to `null`, entry names and comments are decoded ac If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1851,8 +1844,7 @@ An archive entry was compressed by using a compression method that isn't support If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1944,8 +1936,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2017,8 +2008,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2098,8 +2088,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2210,8 +2199,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2291,8 +2279,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2429,8 +2416,7 @@ An archive entry has been compressed using a compression method that isn't suppo Unicode encodings other than UTF-8 can't be used for `entryNameEncoding`, otherwise an is thrown. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2519,8 +2505,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2618,8 +2603,7 @@ An archive entry has been compressed using a compression method that isn't suppo Unicode encodings other than UTF-8 can't be used for `entryNameEncoding`, otherwise an is thrown. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> From cd7e0541f83641cae1bd6b091b2557c947e37229 Mon Sep 17 00:00:00 2001 From: Radek Zikmund Date: Mon, 17 Aug 2026 11:14:09 +0200 Subject: [PATCH 2/3] Add warnings to Tar extract to directory --- xml/System.Formats.Tar/TarFile.xml | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/xml/System.Formats.Tar/TarFile.xml b/xml/System.Formats.Tar/TarFile.xml index 824e005c382..93b8e09b273 100644 --- a/xml/System.Formats.Tar/TarFile.xml +++ b/xml/System.Formats.Tar/TarFile.xml @@ -492,6 +492,11 @@ Files of type , , or can only be extracted in Unix platforms. Elevation is required to extract a or to disk. This method doesn't limit the total extracted size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the size and the number of entries are within acceptable limits for your scenario. + or is . @@ -536,7 +541,13 @@ Extracting one of the tar entries would have resulted in a file outside the spec To be added. To be added. To be added. - To be added. + + + @@ -574,6 +585,11 @@ Extracting one of the tar entries would have resulted in a file outside the spec Files of type , , or can only be extracted in Unix platforms. Elevation is required to extract a or to disk. This method doesn't limit the total extracted size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the size and the number of entries are within acceptable limits for your scenario. + or is . @@ -615,7 +631,13 @@ Extracting one of the tar entries would have resulted in a file outside the spec To be added. To be added. To be added. - To be added. + + + From 2792f5ec266175a375b381e44c8a8ed319588c35 Mon Sep 17 00:00:00 2001 From: Radek Zikmund Date: Mon, 17 Aug 2026 11:20:49 +0200 Subject: [PATCH 3/3] Fix relative link --- includes/tar-zip-extracttodirectory.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/tar-zip-extracttodirectory.md b/includes/tar-zip-extracttodirectory.md index bf107250e92..7a803f90434 100644 --- a/includes/tar-zip-extracttodirectory.md +++ b/includes/tar-zip-extracttodirectory.md @@ -1,2 +1,2 @@ > [!WARNING] -> This method must be used only on trusted archives as it doesn't enforce any size limits, entry count limits, or other policies needed for safe extraction of untrusted archives. Refer to [Best practices for using zip and tar archives](dotnet/standard/io/zip-tar-best-practices) for more information on safely extracting archives from untrusted sources. +> This method must be used only on trusted archives as it doesn't enforce any size limits, entry count limits, or other policies needed for safe extraction of untrusted archives. Refer to [Best practices for using zip and tar archives](/dotnet/standard/io/zip-tar-best-practices) for more information on safely extracting archives from untrusted sources.