Zip Slip in Buffalo with Dynamodb

Zip Slip is a path traversal vulnerability that occurs when an archive extraction uses user-supplied paths without proper sanitization, allowing files to be written outside the intended directory. When this pattern is implemented in a Buffalo application that interacts with Amazon DynamoDB, the risk expands into data integrity and confidentiality concerns. In Buffalo, file uploads or archive processing may temporarily extract payloads to the filesystem before persisting metadata to DynamoDB. If the extracted file paths are not validated, an attacker can craft an archive containing paths like ../../../etc/passwd, causing extraction outside the application’s expected directory. The vulnerability is not in DynamoDB itself, but in how extracted paths are used to construct keys or references that are later stored or queried in DynamoDB.

Consider a Buffalo handler that accepts a CSV export request and stores metadata in DynamoDB. The handler might extract a user-provided archive to a temporary directory and then read filenames to insert into a DynamoDB table for inventory tracking. If the archive contains malicious paths, the extracted files could overwrite configuration files or expose sensitive system files. The DynamoDB entries might then reference these unexpected paths, creating a mismatch between the stored metadata and actual filesystem state. This inconsistency can lead to unauthorized data access or logic bypasses when the application later uses DynamoDB records to locate or serve files. Because Buffalo is convention-based, path construction often relies on string concatenation, increasing the chance of unsafe joins when handling extracted archive members.

Even though DynamoDB is a managed NoSQL service and does not execute filesystem operations, the application layer that maps extracted files to DynamoDB items becomes the weak link. An attacker who can manipulate extracted paths may indirectly affect which items are written or queried, especially if the application uses the extracted filename as a key attribute in DynamoDB. Without strict validation of archive member paths, the attacker can influence key design, cause item collisions, or trigger overwrite conditions in DynamoDB based on crafted input. This illustrates how Zip Slip in Buffalo, combined with DynamoDB usage, can compromise data integrity and lead to insecure access patterns that are difficult to detect without runtime scanning.

To mitigate Zip Slip in Buffalo when using DynamoDB, you must validate and sanitize file paths before any extraction or database interaction. The goal is to ensure that resolved paths remain within a designated base directory and that no path component attempts to traverse outside it. Below is a concrete example of a Buffalo handler that safely extracts a ZIP archive and stores file metadata in DynamoDB using the AWS SDK for Go, with path validation integrated into the extraction loop.

// handler.go
package actions

import (
    "archive/zip"
    "io"
    "net/http"
    "os"
    "path/filepath"
    "strings"

    "github.com/gobuffalo/buffalo"
    "github.com/aws/aws-sdk-go/aws"
    "github.com/aws/aws-sdk-go/aws/session"
    "github.com/aws/aws-sdk-go/service/dynamodb"
    "github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
)

type FileMetadata struct {
    ID    string `json:"id"`
    Name  string `json:"name"`
    Checksum string `json:"checksum"`
}

func ImportArchive(c buffalo.Context) error {
    file, header, err := c.Request().FormFile("archive")
    if err != nil {
        return c.Render(400, r.JSON(&buffalo.Error{Message: err.Error()}))
    }
    defer file.Close()

    baseDir := "/safe/extract"
    allowedPrefix := "imports/"

    zipReader, err := zip.NewReader(file, header.Size)
    if err != nil {
        return c.Render(400, r.JSON(&buffalo.Error{Message: err.Error()}))
    }

    for _, f := range zipReader.File {
        // Validate path to prevent Zip Slip
        if !isValidPath(f.Name, baseDir, allowedPrefix) {
            continue // or return an error
        }
        rc, err := f.Open()
        if err != nil {
            return c.Render(500, r.JSON(&buffalo.Error{Message: err.Error()}))
        }
        defer rc.Close()

        // Ensure the full path is cleaned and joined safely
        fullPath := filepath.Join(baseDir, allowedPrefix, filepath.Clean(f.Name))
        if err := os.MkdirAll(filepath.Dir(fullPath), 0750); err != nil {
            return c.Render(500, r.JSON(&buffalo.Error{Message: err.Error()}))
        }
        outFile, err := os.OpenFile(fullPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, f.Mode()))
        if err != nil {
            return c.Render(500, r.JSON(&buffalo.Error{Message: err.Error()}))
        }
        defer outFile.Close()

        _, err = io.Copy(outFile, rc)
        if err != nil {
            return c.Render(500, r.JSON(&buffalo.Error{Message: err.Error()}))
        }

        // Store metadata in DynamoDB
        sess := session.Must(session.NewSession()) 
        svc := dynamodb.New(sess)
        metadata := FileMetadata{
            ID:      f.Name,
            Name:    filepath.Base(fullPath),
            Checksum: "sha256placeholder",
        }
        item, err := dynamodbattribute.MarshalMap(metadata)
        if err != nil {
            return c.Render(500, r.JSON(&buffalo.Error{Message: err.Error()}))
        }
        input := &dynamodb.PutItemInput{
            TableName: aws.String("FileMetadata"),
            Item:      item,
        }
        _, err = svc.PutItem(input)
        if err != nil {
            return c.Render(500, r.JSON(&buffalo.Error{Message: err.Error()}))
        }
    }
    return c.Render(200, r.JSON(&buffalo.Response{StatusCode: 200}))
}

func isValidPath(path, baseDir, allowedPrefix string) bool {
    cleanPath := filepath.Clean("/" + path)
    if strings.HasPrefix(cleanPath, "../") || strings.Contains(cleanPath, "..\\") {
        return false
    }
    resolved := filepath.Join(baseDir, allowedPrefix, cleanPath)
    if !strings.HasPrefix(resolved, filepath.Clean(baseDir)+string(os.PathSeparator)) && resolved != filepath.Clean(baseDir) {
        return false
    }
    return strings.HasPrefix(cleanPath, allowedPrefix)
}

This example demonstrates how to enforce path constraints specific to Buffalo handlers and integrate them with DynamoDB operations. By validating each archive member before extraction and using filepath.Clean and filepath.Join, you prevent directory traversal attempts. The isValidPath function ensures that only files under the allowed prefix are processed, reducing the risk of Zip Slip when storing metadata in DynamoDB. For production use, consider enhancing checksum validation and error handling to align with your security and compliance requirements.