Zip Slip in Gin with Basic Auth

Zip Slip is a path traversal vulnerability where an attacker-supplied filename in an archive leads to files being extracted outside the intended directory. In Gin, this risk can be exposed when file extraction logic does not validate or sanitize paths, and when Basic Auth is used, it may change how and when extraction occurs.

Consider a Gin endpoint that accepts an uploaded archive and a filename header used to select an entry. If the server uses Basic Auth to gate access to the extraction route, an authenticated user might still provide malicious archive contents. The vulnerability arises not from authentication itself, but from insecure extraction logic that trusts member names in the archive. An attacker who can upload or influence an archive (e.g., via a compromised client or a secondary vector) can craft entries with paths like ../../../etc/passwd. When the server iterates over the archive and writes entries using the member name directly, path traversal occurs, potentially overwriting arbitrary files on the host.

Basic Auth in Gin typically involves checking an Authorization header on each request. If the extraction endpoint is protected by Basic Auth but the archive processing does not enforce strict path checks, the authenticated context gives the attacker a valid session to upload or reference a malicious archive. The combination of authenticated access and unsafe extraction means the attacker can repeatedly probe or trigger extraction logic that would otherwise be less convenient without credentials. Moreover, if the server uses per-request authentication to decide whether to allow extraction, and the extraction code does not enforce path sanitization, the authenticated request will proceed to unsafe file operations, turning a controlled endpoint into a vector for arbitrary file write.

In this scenario, middleBrick’s checks—such as Input Validation and Property Authorization—would highlight missing path sanitization and overly permissive authorization logic. While the scan does not fix the extraction code, its findings map to relevant parts of the OWASP API Top 10 and provide remediation guidance to ensure archive entries are validated and extracted within a safe base directory.

To mitigate Zip Slip in Gin when Basic Auth is used, focus on two areas: secure authentication checks and safe archive extraction. Authentication should be consistent and not gate extraction in a way that bypasses validation. Extraction must always sanitize file paths and restrict writes to a controlled directory.

Below is a secure Gin example that combines Basic Auth with strict path handling. It uses the github.com/gin-gonic/gin package and the standard library archive/zip to demonstrate safe extraction.

//go
package main

import (
    "archive/zip"
    "fmt"
    "io"
    "net/http"
    "os"
    "path/filepath"

    "github.com/gin-gonic/gin"
)

const uploadDir = "./safe_uploads"

// BasicAuth middleware validates Authorization header.
func BasicAuth() gin.HandlerFunc {
    return func(c *gin.Context) {
        user, pass, ok := c.Request.BasicAuth()
        if !ok || !checkCredentials(user, pass) {
            c.Header("WWW-Authenticate", `Basic realm=