diff --git a/includes/tar-zip-extracttodirectory.md b/includes/tar-zip-extracttodirectory.md new file mode 100644 index 00000000000..7a803f90434 --- /dev/null +++ b/includes/tar-zip-extracttodirectory.md @@ -0,0 +1,2 @@ +> [!WARNING] +> This method must be used only on trusted archives as it doesn't enforce any size limits, entry count limits, or other policies needed for safe extraction of untrusted archives. Refer to [Best practices for using zip and tar archives](/dotnet/standard/io/zip-tar-best-practices) for more information on safely extracting archives from untrusted sources. diff --git a/xml/System.Formats.Tar/TarFile.xml b/xml/System.Formats.Tar/TarFile.xml index 824e005c382..93b8e09b273 100644 --- a/xml/System.Formats.Tar/TarFile.xml +++ b/xml/System.Formats.Tar/TarFile.xml @@ -492,6 +492,11 @@ Files of type , , or can only be extracted in Unix platforms. Elevation is required to extract a or to disk. This method doesn't limit the total extracted size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the size and the number of entries are within acceptable limits for your scenario. + or is . @@ -536,7 +541,13 @@ Extracting one of the tar entries would have resulted in a file outside the spec To be added. To be added. To be added. - To be added. + + + @@ -574,6 +585,11 @@ Extracting one of the tar entries would have resulted in a file outside the spec Files of type , , or can only be extracted in Unix platforms. Elevation is required to extract a or to disk. This method doesn't limit the total extracted size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the size and the number of entries are within acceptable limits for your scenario. + or is . @@ -615,7 +631,13 @@ Extracting one of the tar entries would have resulted in a file outside the spec To be added. To be added. To be added. - To be added. + + + diff --git a/xml/System.IO.Compression/ZipFile.xml b/xml/System.IO.Compression/ZipFile.xml index ae46cc12680..498acfda957 100644 --- a/xml/System.IO.Compression/ZipFile.xml +++ b/xml/System.IO.Compression/ZipFile.xml @@ -1156,8 +1156,7 @@ An I/O error occurred while opening a file to be archived. If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1235,8 +1234,7 @@ An archive entry was compressed by using a compression method that isn't support If an entry in the zip archive is a symbolic link, it's extracted as a regular folder since symbolic link information isn't preserved in the ZIP format. If `destinationDirectoryName` or any of its parent directories is a pre-existing junction or symbolic link, the link is followed and the extraction writes to the final target folder. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ## Examples This example shows how to create and extract a zip archive by using the class. It compresses the contents of a folder into a zip archive and extracts that content to a new folder. To use the class, you must reference the `System.IO.Compression.FileSystem` assembly in your project. @@ -1321,8 +1319,7 @@ An archive entry was compressed by using a compression method that isn't support If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1433,8 +1430,7 @@ An archive entry was compressed by using a compression method that isn't support If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1520,8 +1516,7 @@ If `destinationDirectoryName` or any of its parent directories is a pre-existing If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1662,9 +1657,8 @@ If `entryNameEncoding` is set to `null`, entry names and comments are decoded ac - For entries where the language encoding flag (in the general-purpose bit flag of the local file header) is not set, entry names and comments are decoded by using the current system default code page. - For entries where the language encoding flag is set, the entry names and comments are decoded by using UTF-8. - -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. + +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1755,8 +1749,7 @@ If `entryNameEncoding` is set to `null`, entry names and comments are decoded ac If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1851,8 +1844,7 @@ An archive entry was compressed by using a compression method that isn't support If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -1944,8 +1936,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2017,8 +2008,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2098,8 +2088,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2210,8 +2199,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2291,8 +2279,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2429,8 +2416,7 @@ An archive entry has been compressed using a compression method that isn't suppo Unicode encodings other than UTF-8 can't be used for `entryNameEncoding`, otherwise an is thrown. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2519,8 +2505,7 @@ An archive entry has been compressed using a compression method that isn't suppo If a file to be archived has an invalid last modified time, the first date and time representable in the zip timestamp format (midnight on January 1, 1980) will be used. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]> @@ -2618,8 +2603,7 @@ An archive entry has been compressed using a compression method that isn't suppo Unicode encodings other than UTF-8 can't be used for `entryNameEncoding`, otherwise an is thrown. -> [!WARNING] -> This method doesn't limit the total uncompressed size or the number of entries extracted from the archive. When processing archives from untrusted sources, iterate over the entries manually using , and validate that the total uncompressed size and the number of entries are within acceptable limits for your scenario. +[!INCLUDE[tar-zip-extracttodirectory](~/includes/tar-zip-extracttodirectory.md)] ]]>