Merge pull request #5 from Meloong-Git/copilot/add-zipslip-vulnerability-tests

test: add ZipSlip security tests (dotdot traversal + absolute path)

Tests/MeloongCore.Tests.csproj

@@ -18,6 +18,8 @@
 	  <None Remove="TestFiles\FileUtils\Gzip.gz" />
 	  <None Remove="TestFiles\FileUtils\Not zip.zip" />
 	  <None Remove="TestFiles\FileUtils\UTF8 Encoding.zip" />
+	  <None Remove="TestFiles\FileUtils\DotDot ZipSlip.zip" />
+	  <None Remove="TestFiles\FileUtils\AbsPath ZipSlip.zip" />
 	</ItemGroup>
 
 	<ItemGroup>
@@ -50,6 +52,12 @@
 	  <Content Include="TestFiles\FileUtils\Not zip.zip">
 	    <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
 	  </Content>
+	  <Content Include="TestFiles\FileUtils\DotDot ZipSlip.zip">
+	    <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+	  </Content>
+	  <Content Include="TestFiles\FileUtils\AbsPath ZipSlip.zip">
+	    <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+	  </Content>
 	</ItemGroup>
 
 	<ItemGroup>

Tests/Utils/FileUtilsTest.cs

@@ -34,6 +34,13 @@ public class FileUtilsTest : TestWithFolder {
         Assert.Throws<InvalidDataException>(() => FileUtils.ExtractToDirectory(GetTestFile(testFile), tempFolder));
     }
 
+    [Theory]
+    [InlineData("DotDot ZipSlip.zip")]
+    [InlineData("AbsPath ZipSlip.zip")]
+    public void Compression_ZipSlip(string testFile) {
+        Assert.Throws<UnauthorizedAccessException>(() => FileUtils.ExtractToDirectory(GetTestFile(testFile), tempFolder));
+    }
+
     #endregion