How to Create & Extract ZIP Archives Safely: Avoiding Zip Slip Exploits
ZIP files are the foundation of digital archiving and data bundling, but unpacking unfamiliar archives can expose your system to critical path traversal attacks. Learn how ZIP binary structures work and why in-browser extraction provides a security advantage.
The Internal Architecture of a ZIP File
Standardized by Phil Katz in 1989 (the PKZIP format), a ZIP archive is composed of three consecutive sections:
- Local File Entries: Each stored file begins with a
Local File Header(signature0x04034b50), containing file metadata, followed immediately by the compressed DEFLATE byte payload. - The Central Directory: Positioned near the end of the file, this catalog lists every single file in the archive, its byte offset, uncompressed size, CRC32 checksum, and directory path.
- End of Central Directory Record (EOCD): A 22-byte structure (signature
0x06054b50) that marks where the central directory starts and records the total number of files.
The Major Vulnerability: "Zip Slip" (Path Traversal)
When you create an archive containing a file inside a subfolder, the file name entry inside the Central Directory is stored as a relative string (e.g., documents/contract.pdf).
A malicious actor can craft a weaponized ZIP file where the file name contains parent directory navigation tokens:
⚠️ Malicious ZIP Path Traversal Example
../../../../../../Windows/System32/evil.dll
../../../../../../home/user/.bashrc
If an unpatched desktop extraction tool or server script extracts this archive without sanitizing the path, the file writes outside the designated target folder and overwrites critical operating system files or executable startup scripts. This vulnerability is formally tracked as Zip Slip.
How FileWorks Enforces Anti-Zip-Slip Protection
FileWorks executes all extraction in the browser via JSZip, and strictly validates every archive entry before exposing it to the user via FileToolsLib._validateZipPath:
- Leading Slash Rejection: Any path starting with
/or\is blocked immediately. - Dot-Dot Token Rejection: The path is split by directory separators. If any segment matches
.., an immediate security exception is thrown. - Absolute Drive Letter Rejection: Paths attempting to target Windows drives (e.g.
C:\) are rejected. - Browser Sandboxing: Furthermore, browser JavaScript does not have direct write access to your computer's filesystem. When you download a file, the browser prompts you through your operating system's standard safe download sandbox.
Step-by-Step: Creating and Extracting ZIPs in FileWorks
Creating an Archive:
- Navigate to FileWorks Create ZIP.
- Drag and drop up to 10 files (documents, pictures, spreadsheets).
- Enter your preferred archive filename (e.g.
Project-Assets.zip). - Click Create ZIP Archive. FileWorks applies level 6 DEFLATE compression in memory and serves the bundle instantly.
Extracting an Archive:
- Navigate to FileWorks Extract ZIP.
- Drop your ZIP archive into the workspace.
- Inspect the contents table showing individual file sizes and extensions.
- Click Download on any specific file you need, or click Download All.
Manage Archives Safely
Create and extract ZIP archives with built-in path traversal protection.