Seven Security Checks Before Extraction with ZipFlow

ZipFlow introduces a structured, transparent security model for archive extraction. Before a single byte is written to disk, the engine evaluates seven distinct check categories, each assigned a severity weight: low (3 points), medium (12 points), high (30 points), critical (60 points). The final health score starts at 100 and decrements based on findings. The "risk label" (low, medium, high, critical) is determined by the most severe single finding, not an average.

The seven checks:

Path traversal (Zip Slip, CWE-22) – Detects ../ segments, absolute paths, drive letters, UNC paths that could escape the destination directory.
Symlink escape – Detects symbolic links pointing outside the extraction root, with write-through paths.
Compression bomb – Flags extreme expansion ratios, oversized declared outputs, and suspicious entry counts that could exhaust disk or memory.
Weak encryption – Identifies legacy ZipCrypto usage, outdated parameters, and unverifiable encrypted entries.
Integrity anomalies – Checks for truncated data, missing end-of-central-directory records, CRC mismatches, and inconsistent size fields.
Embedded executables – Detects .exe, .scr, .bat, .cmd, .ps1, .lnk, .js, and macro-enabled Office files inside archives.
Duplicate / case-conflicting names – Prevents two entries with the same path or names that collide on case-insensitive Windows volumes.
CLI usage: zf s archive.zip --json outputs the full report. Exit code 3 is returned only for critical path traversal or symlink escape; other findings return 0, allowing CI systems to set their own thresholds.

Why it matters: Most archive tools only test CRC or rely on antivirus. ZipFlow's model helps automate safer extractions in CI, scripting, and desktop automation.

下载: Microsoft Store