Adding Item To Process Event

The AddingItemToProcess event is raised when an item pair (current item and target item) is about to be added to a list of items to process.

Purpose

The AddingItemToProcess event allows an application to examine an item pair, replace it or exclude the pair from the list of items to be processed by a method.

The following methods can raise the AddingItemToProcess event:

Method	Description
FileSystemItem.CopyTo()	Copies the item to another folder.
FileSystemItem.MoveTo()	Moves the item to another folder.
FileSystemItem.Create()	Creates the physical item.
FileSystemItem.Delete()	Permanently deletes the physical item.
AbstractFolder.CopyFilesTo()	Copies the folder's files to another folder.
AbstractFolder.MoveFilesTo()	Moves the folder's files to another folder.
AbstractFolder.CopyItemsTo()	Copies the folder's files and folders to another folder.
AbstractFolder.MoveItemsTo()	Moves the folder's files and folders to another folder.

Demonstration

The AddingItemToProcess event can be used to filter out potentially dangerous zipped items whose names contain relative path elements (like ..\..\) that, during an unzip operation can create or overwrite files outside of the base destination folder.

C#
VB.NET

public static void ZipSlip()

{

  AbstractFile zipFile = new DiskFile( "ZipSlip1.zip" );



  if( !zipFile.Exists )

    throw new InvalidProgramException( "The zip file must exist for this example to work correctly" );



  // Create a logical zip archive around the zip file

  ZipArchive zip = new ZipArchive( zipFile );



  // Create a FileSystemEvents object

  FileSystemEvents events = new FileSystemEvents();



  // Subscribe to the AddingItemToProcess event

  events.AddingItemToProcess += OnAddingItemToProcessExclude;



  // Setup a destination folder

  AbstractFolder destinationFolder = new DiskFolder( @"D:\ZipSlip\Output" );



  // User the destination folder as userData

  object userData = destinationFolder;



  // Unzip the contents of the archive

  zip.CopyFilesTo( events, userData, destinationFolder, true, true );

}



private static void OnAddingItemToProcessExclude( object sender, ItemProcessingEventArgs e )

{

  // Retrieve the destination folder from the user data

  AbstractFolder destinationFolder = ( AbstractFolder ) e.UserData;

  string destinationFullname = destinationFolder.FullName;



  FileSystemItem destinationItem = e.TargetItem;

  string targetPath = destinationItem.FullName;



  // If the target path does not start with the destination path

  if( !targetPath.StartsWith( destinationFullname ) )

  {

    /* The zipped item contains relative path modifiers that make the destination

       go outside the base destination path. In some controlled situations, that

       might be ok, but we chose not to allow it here. We will exclude this item. */



    e.Excluded = true;

  }

}

Public Shared Sub ZipSlip()

  Dim zipFile As AbstractFile = New DiskFile("ZipSlip1.zip")



  If (Not zipFile.Exists) Then

    Throw New InvalidProgramException("The zip file must exist for this example to work correctly")

  End If



  ' Create a logical zip archive around the zip file

  Dim zip As New ZipArchive(zipFile)



  ' Create a FileSystemEvents object

  Dim events As New FileSystemEvents()



  ' Subscribe to the AddingItemToProcess event

  AddHandler events.AddingItemToProcess, AddressOf OnAddingItemToProcessExclude



  ' Setup a destination folder

  Dim destinationFolder As AbstractFolder = New DiskFolder("D:\ZipSlip\Output")



  ' User the destination folder as userData

  Dim userData As Object = destinationFolder



  ' Unzip the contents of the archive

  zip.CopyFilesTo(events, userData, destinationFolder, True, True)

End Sub



Private Shared Sub OnAddingItemToProcessExclude(ByVal sender As Object, ByVal e As ItemProcessingEventArgs)

  ' Retrieve the destination folder from the user data

  Dim destinationFolder As AbstractFolder = CType(e.UserData, AbstractFolder)

  Dim destinationFullname As String = destinationFolder.FullName



  Dim destinationItem As FileSystemItem = e.TargetItem

  Dim targetPath As String = destinationItem.FullName



  ' If the target path does not start with the destination path

  If (Not targetPath.StartsWith(destinationFullname)) Then

    ' The zipped item contains relative path modifiers that make the destination

    ' go outside the base destination path. In some controlled situations, that

    ' might be ok, but we chose not to allow it here. We will exclude this item. 



    e.Excluded = True

  End If

End Sub