little ether
Does zig have a zip library (to read and write zip files)?
I saw it has deflate/gzip/zlib, but I am looking for something that can do things like list entries, read individual entries, protect against zip bombs/path escapes, etc.
Or is there a recommended C library I can wrap?
hardy pumice
There's one on github but not up to date: https://github.com/SuperAuguste/zarc
rustic snow
libzip would be a C library you could wrap afaik
hardy pumice
Yeah, libzip shouldn't be too hard to use from zig
worn orchid
zarc is currently the only pure zig library for zips (but only supports reading), I'm in the process of rewriting it to do both reading and writing
it shouldn't be too far away from compiling with master
little ether
thanks! I will look at them 👍
pale torrent
https://github.com/foxnne/pixi/tree/main/src/deps/zip
If you'd like feel free to steal this as well, works for me on mac/win/linux.
hoary creek
if you only want to read, the zip format isn't hard. not designed to be secure tho so such a tool would be good. i believe such tools exist and pentesting types use them, probably in c. i wouldn't bet on libzip having all the tools necessary if that's what you want to do. i watched a video when i was learning the zip format on various exploits due to its format being underspecified etc. i don't know specifically about zip bombs. i think there are multiple kinds of zip bombs tho
rustic snow
libzip should probably have everythin you need, considering it's used in Chrome, Plex, and a boat load of other things
hoary creek
does it check for the directory both forwards and backwards? that's maybe the most obvious way it's been exploited. you can have two directories and different tools find different ones depending on whether they look forwards or backwards. there's a couple of other methods too. i'm no expert but whenever you play with file formats at a low level you see all kinds of possibilities. people that look for exploits are better at seeing these things than me. i'll quickly see if i can find the video...
