ZIP entry names are not trusted filesystem paths. Extraction must remain within the application's permitted destination.
Evaluation approach
Normalize and validate each destination against the allowed root. Limit expanded size and file count.
Application example
An offline map importer should write only within its data directory and reject malformed packages without changing existing configuration.
Limits and considerations
An extension check does not prevent path traversal or excessive expansion.
Cleanup after failed extraction
Partially extracted files must not become usable on the next run. Consider validating in a temporary area and promoting only complete content. Rejected packages must not mix unchecked data into an older configuration.
Checks and decisions
- Validate destinations
- Limit expanded size
- Clean partial files
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.