osy ed73d11da0 download: reject ZIP entries escaping the .utm folder ...

A downloaded VM archive is attacker-controlled, so an entry named
`some.utm/../../elsewhere` must not be able to write outside the package
it claims to belong to. The extraction path was built by substituting the
archive's .utm prefix out of the entry path and appending the remainder,
and `appendingPathComponent()` does not resolve `..` -- the traversal was
only resolved by the filesystem at write time, landing anywhere in the
app container the depth reached.

Derive the relative path by dropping the prefix, and resolve every
destination through a containment check before extracting. Separators are
collapsed in a loop because `fopen()` and `URL.standardized` disagree on
a path such as `/../elsewhere`, and a single collapse pass still lets
`///../elsewhere` through.

Also bump ZIPFoundation to 0.9.20 for its accumulated fixes. This file is
the only call site in the tree and the deprecated failable initializer it
uses is still present, so the bump is source compatible.

Reported-by: Vo Duc Thang (ugvxb)
Assisted-by: Claude:claude-fable-5-1

2026-09-01 12:30:12 -07:00

..

xcshareddata

download: reject ZIP entries escaping the .utm folder

2026-09-01 12:30:12 -07:00

contents.xcworkspacedata

Make working on the project slightly less annoying

2020-02-23 23:02:38 -08:00