القائمة
Generate secure code for archive decompression. Enforces secure decompression of the content. Invoke when writing any archive decompression related code.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
| name | secure-archive-decompression |
| description | Generate secure code for archive decompression. Enforces secure decompression of the content. Invoke when writing any archive decompression related code. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to archive content decompression whatever the format of the archive.
../ or ..\ or start by /.// BAD: No validation is performed for any points
String zipFilePath = "archive.zip";
File destDir = new File("/output");
try (ZipInputStream zis = new ZipInputStream(new FileInputStream(zipFilePath))) {
ZipEntry entry;
while ((entry = zis.getNextEntry()) != null) {
File outFile = new File(destDir, entry.getName());
if (entry.isDirectory())
{
outFile.mkdirs();
} else
{
outFile.getParentFile().mkdirs();
try (FileOutputStream fos = new FileOutputStream(outFile)) {
byte[] buffer = new byte[4096];
int len;
while ((len = zis.read(buffer)) > 0) {
fos.write(buffer, 0, len);
}
}
}
zis.closeEntry();
}
}
// GOOD: All the points are validated
String zipFilePath = "archive.zip";
File destDir = new File("/output");
int entryCount = 0;
long totalSize = 0;
int MAX_ENTRIES = 20;
int MAX_DEPTH = 10;
long MAX_TOTAL_SIZE = 50L * 1024 * 1024; // 50 MB
long MAX_ENTRY_SIZE = 10L * 1024 * 1024; // 10 MB
String canonicalDest = destDir.getCanonicalPath();
try (ZipInputStream zis = new ZipInputStream(new FileInputStream(zipFilePath))) {
ZipEntry entry;
while ((entry = zis.getNextEntry()) != null) {
String name = entry.getName();
// ── Rule 1: no path traversal, no absolute paths ──────────────
if (name.startsWith("/") || name.contains("../") || name.contains("..\\")) {
throw new IOException("Illegal entry name: " + name);
}
// ── Rule 2: canonical path check (prevents encoded/OS-specific bypasses) ──
File outFile = new File(destDir, name);
String canonicalEntry = outFile.getCanonicalPath();
if (!canonicalEntry.startsWith(canonicalDest + File.separator)) {
throw new IOException("Path traversal detected: " + name);
}
// ── Rule 3: no symlinks or hard links ─────────────────────────
if (Files.isSymbolicLink(outFile.toPath())) {
throw new IOException("Symbolic link entry rejected: " + name);
}
// Note: the ZIP format has no hard-link entry type (unlike tar), so
// ZipInputStream cannot create hard links during extraction. No runtime
// check is required here; the symlink check above is sufficient for ZIP.
// For tar-based formats use your library's API to detect LNKTYPE entries.
// ── Rule 4: max number of entries ─────────────────────────────
if (++entryCount > MAX_ENTRIES) {
throw new IOException("Archive exceeds maximum entry count of " + MAX_ENTRIES);
}
// ── Rule 5: max directory depth ───────────────────────────────
int depth = name.split("[/\\\\]").length;
if (depth > MAX_DEPTH) {
throw new IOException("Entry exceeds max depth of " + MAX_DEPTH + ": " + name);
}
if (entry.isDirectory()) {
outFile.mkdirs();
zis.closeEntry();
continue;
}
outFile.getParentFile().mkdirs();
// ── Rules 6 & 7: size limits ──────────────────────────────────
try (FileOutputStream fos = new FileOutputStream(outFile)) {
byte[] buffer = new byte[4096];
long entrySize = 0;
int len;
while ((len = zis.read(buffer)) > 0) {
entrySize += len;
totalSize += len;
// Rule 7: single-entry size
if (entrySize > MAX_ENTRY_SIZE) {
throw new IOException(
"Entry \"" + name + "\" exceeds max size of " + MAX_ENTRY_SIZE / (1024 * 1024) + " MB");
}
// Rule 6: cumulative size
if (totalSize > MAX_TOTAL_SIZE) {
throw new IOException(
"Archive exceeds total decompressed size of " + MAX_TOTAL_SIZE / (1024 * 1024) + " MB");
}
fos.write(buffer, 0, len);
}
}
zis.closeEntry();
}
}
Before finalizing generated code, verify: