archive/zip package. OpenReader() and File[].Name are sources of user-controlled filenames — Zip Slip path traversal when extracting.
.OpenReader().OpenReader()SourceOpenReader(name string) (*ReadCloser, error)
Opens zip file for reading. File.Name fields are user-controlled — Zip Slip source.
| FQN | Field | |
|---|---|---|
| archive/zip | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
// standard library — no go.mod entry required
from codepathfinder.go_rule import GoArchiveZip