rspec/rules/S4639/csharp/rule.adoc

== Why is this an issue?

include::../description.adoc[]

=== Noncompliant code example

[source,csharp]
----
using System.IO;
using System.IO.Compression;

public class ZipHelper
{
    public void Extract(ZipFile zipFile, string destinationDirectory)
    {
        foreach (var entry in zipFile.Entries)
        {
            var destinationFileName = Path.GetFullPath(Path.Combine(destinationDirectory, entry.FullName));
            entry.ExtractToFile(destinationFileName); // entry.FullName could contain parent directory references (..) and make the
                                                      // file to be extracted in an arbitrary directory, outside of destinationDirectory
        }
    }
}
----

=== Compliant solution

[source,csharp]
----
using System.IO;
using System.IO.Compression;

public class ZipHelper
{
    public void Extract(ZipFile zipFile, string destinationDirectory)
    {
        foreach (var entry in zipFile.Entries)
        {
            var destinationFileName = Path.GetFullPath(Path.Combine(destinationDirectory, entry.FullName));
            if (destinationFullName.StartsWith(destinationDirectory)) // Do not extract files if the destination file path will be outside of destinationDirectory
            {
                entry.ExtractToFile(destinationFileName); // Compliant, destinationFileName is ensured to be under destinationDirectory
            }
        }
    }
}{code}
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]