Security Advisories (2)
CVE-2018-10860 (2018-06-28)

perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.

CVE-2004-1096 (2005-01-10)

Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

NAME

Archive::Zip::Tree -- methods for adding/extracting trees using Archive::Zip

SYNOPSIS

use Archive::Zip;
use Archive::Zip::Tree;
my $zip = Archive::Zip->new();
# add all readable files and directories below . as xyz/*
$zip->addTree( '.', 'xyz' );	
# add all readable plain files below /abc as /def/*
$zip->addTree( '/abc', '/def', sub { -f && -r } );	
# add all .c files below /tmp as stuff/*
$zip->addTreeMatching( '/tmp', 'stuff', '\.c$' );
# add all .o files below /tmp as stuff/* if they aren't writable
$zip->addTreeMatching( '/tmp', 'stuff', '\.o$', sub { ! -w } );
# and write them into a file
$zip->writeToFileNamed('xxx.zip');

# now extract the same files into /tmpx
$zip->extractTree( 'stuff', '/tmpx' );

METHODS

$zip->addTree( $root, $dest [,$pred] )

$root is the root of the tree of files and directories to be added

$dest is the name for the root in the zip file (undef or blank means to use relative pathnames)

$pred is an optional subroutine reference to select files: it is passed the name of the prospective file or directory using $_, and if it returns true, the file or directory will be included. The default is to add all readable files and directories.

For instance, using

my $pred = sub { /\.txt/ };
$zip->addTree( '.', '.', $pred );

will add all the .txt files in and below the current directory, using relative names, and making the names identical in the zipfile:

original name           zip member name
./xyz                   xyz
./a/                    a/
./a/b                   a/b

To use absolute pathnames, just pass them in:

$zip->addTree( '/a/b', '/a/b' );

original name           zip member name
/a/                     /a/
/a/b                    /a/b

To translate relative to absolute pathnames, just pass them in:

$zip->addTree( '.', '/c/d' );

original name           zip member name
./xyz                   /c/d/xyz
./a/                    /c/d/a/
./a/b                   /c/d/a/b

To translate absolute to relative pathnames, just pass them in:

$zip->addTree( '/c/d', 'a' );

original name           zip member name
/c/d/xyz                a/xyz
/c/d/a/                 a/a/
/c/d/a/b                a/a/b

Returns AZ_OK on success.

Note that this will not follow symbolic links to directories.

Note also that this does not check for the validity of filenames.

$zip->addTreeMatching( $root, $dest, $pattern [,$pred] )

$root is the root of the tree of files and directories to be added

$dest is the name for the root in the zip file (undef means to use relative pathnames)

$pattern is a (non-anchored) regular expression for filenames to match

$pred is an optional subroutine reference to select files: it is passed the name of the prospective file or directory in $_, and if it returns true, the file or directory will be included. The default is to add all readable files and directories.

To add all files in and below the current dirctory whose names end in .pl, and make them extract into a subdirectory named xyz, do this:

$zip->addTreeMatching( '.', 'xyz', '\.pl$' )

To add all writable files in and below the dirctory named /abc whose names end in .pl, and make them extract into a subdirectory named xyz, do this:

$zip->addTreeMatching( '/abc', 'xyz', '\.pl$', sub { -w } )

Returns AZ_OK on success.

Note that this will not follow symbolic links to directories.

$zip->extractTree()
$zip->extractTree( $root, $dest )

If you don't give any arguments at all, will extract all the files in the zip with their original names.

If you give arguments, extractTree extracts all the members below a given root. Will translate that root to a given dest pathname.

For instance,

$zip->extractTree( '/a/', 'd/e/' );

when applied to a zip containing the files: /a/x /a/b/c /d/e

will extract: /a/x to d/e/x /a/b/c to d/e/b/c

and ignore /d/e

AUTHOR

Ned Konz, perl@bike-nomad.com

COPYRIGHT

Copyright (c) 2000 Ned Konz. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

Compress::Zlib Archive::Zip