0

I'm trying to download a zip off DropBox and put it into a certain local folder (which works) but when i try to extract the zip it says 'Extracting Zip entry would have resulted in a file outside the specified destination directory'

I have no clue on why it says that and when I googled stuff about it they didn't really help at all and past questions just led to more questions rather than a solution...

When the file is downloaded and extracted manually it works fine; no errors what so ever, but when I try to do it programmatically it says the error above. Relevant code is bellow

using (var client = new WebClient())
            {
                string appData = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
                string extractPath = @"\Chrome\AutoStartUp\AutoStartUp.zip";
                string FullPath = appData + extractPath;
                //this is for allowing the download on your browser
                ServicePointManager.ServerCertificateValidationCallback +=
                    (sender, certificate, chain, errors) =>
                    {
                        return true;
                    };
                client.DownloadFile("link goes here", FullPath);
                //downloads the zip file with the name 'AutoStartUp.zip'
                
                //this gets the absolute path to the 'AutoStartUp.zip' and tries to extract it to the folder it resides in
                ZipFile.ExtractToDirectory(FullPath, appData + @"\Chrome\AutoStartUp");
                
            }

If i try to extract another zip with the same code but change out the zip name it works fine. Is there also another way to extract a zip without

ZipFile.ExtractToDirectory

I'm using .NET 3.1 (btw there is no compiling error it throws the error upon running)

I FOUND THE ERROR I was using drop box to download my files from but when i uploaded my files to drop box it was uploading them as a folder not a zip. so when it downloaded the folder to a dir names AutoStartUp.zip it was trying to extract a folder which therefore threw the error. To fix it i just had to make sure it was downloading a zip file and not a folder.

Chris hansen
  • 31
  • 1
  • 5
  • 1
    It's a nasty zip that tries to write outside the directory where you extract it, by using filenames such as `..\..\..\..\Windows\System32\cmd.exe`, for example. See duplicate. – CodeCaster Mar 30 '21 at 22:57
  • All the places i look say the same thing but it just doesn't have any file names like that. That is the thing which confuses me the most. – Chris hansen Mar 30 '21 at 23:07
  • I just tested something where i change it so it downloaded a text file called test.txt and it still says the same error. There is no way that it cannot extract test.txt. – Chris hansen Mar 30 '21 at 23:13
  • This is a security mechanism to protect against the zip slip vulnerability: https://www.meziantou.net/prevent-zip-slip-in-dotnet.htm – meziantou Mar 30 '21 at 23:18
  • You cannot extract a .txt file. – CodeCaster Mar 30 '21 at 23:21
  • I found the error, look at my question at the bottom and it says what was causing the issue. – Chris hansen Mar 31 '21 at 11:02

0 Answers0