A service extracts user-uploaded archives to disk, using the member names stored inside the archive. Explain why that hands an attacker a file-write primitive, and what a safe extractor verifies that a naive one does not — beyond rejecting names that contain `..`.

## Why extraction is a write primitive A read-only traversal lets an attacker choose which of your files they see. Extraction lets them choose the name **and** the content, for as many files as they can fit in the upload. That converts routinely into code execution: drop into a directory that something later interprets — a startup or scheduled-job directory, a web root, a plugin or template directory, a shell profile, a configuration file that a privileged process reads — and the write becomes an execution at whatever privilege that consumer runs with. Rank archive extraction above ordinary file reads for this reason alone. The structural cause is simple and worth saying plainly: **archive member names are attacker-authored strings in formats that never guaranteed they were relative or benign.** A zip's central directory stores a name field; a tar header stores a name field. Nothing in either format constrains those to be relative, to lack `..`, or to be distinct from one another. The extractor is a resolver, and the archive is a program written for it. ## What a naive extractor checks, and what it misses A naive extractor rejects names containing `..` and joins the rest under a destination. Here is what escapes that. **Absolute and platform-qualified names.** A member named `/etc/cron.d/job` is well-formed. So are drive-relative and drive-absolute Windows names, and names using `\` as a separator — which a POSIX-oriented check treats as an ordinary character while a Windows extractor treats as a directory separator. `\\?\` and UNC prefixes change parsing mode entirely. **Link members — the case that defeats per-name checking.** Archive formats can carry symbolic and hard links as members. Extract a member named `logs` whose type is *symlink* and whose target is `/etc`; then extract a member named `logs/cron.d/job`. Neither name contains `..`, neither is absolute, and both pass a purely lexical check. The escape emerges from the **sequence**: the first member installed an operator into the namespace, and the second member's name resolved through it. This is the sharpest illustration that traversal is about resolution, not about strings, and it is the single thing most worth being able to describe in an interview. The same trick with a hard link to a sensitive file turns a write into a write *into* that file. **Collisions that are not visible in the raw bytes.** Two members named `Config` and `config` are distinct in the archive and the same file on a case-insensitive filesystem. Two members differing only by Unicode normalisation form can collapse to one name. A trailing dot or space can be stripped by the resolver. In each case the second write silently replaces the first, which defeats any scheme that validated file *contents* on the first write. **Restored metadata.** Modes and ownership recorded in the archive are attacker-controlled. Restoring a setuid bit or a world-writable mode from an untrusted archive is a privilege problem that has nothing to do with the name at all. ## What a safe extractor does Order the controls the same way as any other resolution defence. *Strongest — do not use the archived names.* Write each entry to a name your code generates and keep the archived name as metadata in a database or manifest. This is closed-world enumeration applied to extraction: the set of names your process can create is finite and owned by you, so the entire class disappears rather than being detected. It is available far more often than people assume; most systems only need the original name for display or for a later download filename. *Next — extract through a resolver that cannot escape.* Extract inside a jail or namespace rooted at the destination, or open each target relative to a directory handle with a resolve-beneath constraint and without following links. Then the hostile name is inexpressible as an escape. *Otherwise — resolve and containment-test, per member, after link resolution*, with the comparison done component-wise against a destination captured once. Refuse to create link members at all; refuse duplicate names after case folding and normalisation; refuse absolute and platform-qualified forms; do not restore modes or ownership. Extract into a fresh directory that no other principal can write to, so the parent chain itself cannot be redirected mid-extraction. *And separately* — resource limits. Declared versus actual size, total entry count, nesting depth. A decompression bomb is an availability problem rather than a traversal, but it lands on the same code path and any real extractor needs both. ## The one-sentence version An archive is a list of writes whose destinations the attacker wrote down; per-name string checks fail because one member can change how the next member's name resolves, so containment has to be tested on each member's resolved destination — or, better, the names should never have been used.