DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
C#

C#

Made by DeepSource
Use Analyzer

Audit required: Path used in archive extraction maybe unsanitized CS-A1014

Security
Major
 a03 a01 cwe-20 cwe-22 sans top 25 owasp top 10 cwe-99 cwe-641

The ExtractToFile() method takes in a parameter that specifies the destination to which the archive is to be extracted. However, it is possible that this parameter may be unsanitized, especially if it is manually constructed. In such cases, you may end up extracting the archive to a destination outside your control, especially if one or more parameters are obtained via user input. It is therefore recommended that you ensure that this destination is precisely what you need, meaning, the archive is being extracted to the destination that you intend to.

Bad Practice

var destination = directory + folder;
archive.ExtractToFile(destination);

Recommended

var destination = directory + folder;
if (destination.StartsWith(safeDestination))
{
    archive.ExtractToFile(destination);
}

Reference