Fix/utils extract zip by muhammadolammi · Pull Request #885 · meshery/meshkit

muhammadolammi · 2026-01-03T10:35:04Z

Description

This fixes the bug in the ExtractZip function; it currently creates all subfolders of the zip inside cwd when using "filename". By using filepath, we make sure it's produced in /tm,p, which other functions calling ExtractZip (like the ProcessContent) expect and depend on

Notes for Reviewers
This PR depends on "fix syntax error in registry/model.go #884" Please merge #884 first.

Signed commits

Yes, I signed my commits.

gemini-code-assist · 2026-01-03T10:35:22Z

Summary of Changes

Hello @muhammadolammi, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical bug in the ExtractZip utility, ensuring that extracted files and directories are correctly placed in the designated target path, typically a temporary directory. This fix is essential for the proper functioning of other components, such as ProcessContent, which rely on this utility to process content from zip archives without scattering files across the current working directory. Additionally, minor formatting adjustments were made in registry/model.go for improved readability.

Highlights

Bug Fix in Zip Extraction: The ExtractZip utility function now correctly extracts zip archive contents to the specified target directory (path) instead of inadvertently creating subfolders in the current working directory. This resolves an issue where dependent functions expected files in a specific temporary location.
Improved Directory Handling: The logic for creating directories during zip extraction has been enhanced by switching from os.Mkdir to os.MkdirAll, ensuring that all necessary parent directories are created automatically if they do not already exist.
Refactored File Operations: The internal handling of file opening and copying within the ExtractZip function has been refactored for better error management and resource cleanup. This includes moving defer statements for file descriptors inside the loop and adding a check to skip macOS resource fork files (those prefixed with ._).

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request fixes a bug in the ExtractZip function to correctly handle file paths during extraction, preventing files from being created in the current working directory. The changes also include significant improvements to resource management by fixing a file descriptor leak and using a more efficient method for copying file data. Additionally, a syntax and logic error in a loop within registry/model.go is corrected. My review identifies a critical security vulnerability (Zip Slip) in the updated ExtractZip function and provides a suggestion to mitigate it.

utils/unarchive.go

…rent /tmp sub folder instead of cwd Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

…kipped file Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

leecalcote · 2026-01-07T03:35:56Z

@parthivsaikia, perhaps, you might offer review or @lekaf974 might have a comment or two.

utils/zip_test.go

lekaf974 · 2026-01-09T12:51:10Z

utils/unarchive.go

-			return ErrExtractZip(err, path)
-		}
+			if !strings.HasPrefix(targetPath, destDir+string(os.PathSeparator)) && targetPath != destDir {
+				return fmt.Errorf("zipslip: illegal file path: %s", file.Name)


This must return a meshkit error, ErrExtractZip looks a good candidate

lekaf974 · 2026-01-09T12:51:48Z

utils/unarchive.go

+			fd, err := file.Open()
 			if err != nil {
-				return ErrExtractZip(err, path)
+				return err


this must be a meskit error as well

lekaf974

Hi @muhammadolammi, thank you for this PR.

Please ensure all errors returned are meshkit errors

Documentation: https://docs.meshery.io/project/contributing/contributing-error

muhammadolammi · 2026-01-09T18:05:05Z

Hi @muhammadolammi, thank you for this PR.

Please ensure all errors returned are meshkit errors

Documentation: https://docs.meshery.io/project/contributing/contributing-error

The errors in this function are wrapped with ErrExtractZip. The naked errors are in the closure function, where we call a function in the for loop that returns a Go error. Then, we check if it's a non-nil error and return an ErrExtractZip error of that error. I think it's a good design

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

gemini-code-assist bot reviewed Jan 3, 2026

View reviewed changes

utils/unarchive.go Outdated Show resolved Hide resolved

muhammadolammi added 6 commits January 3, 2026 12:27

fix ExtractZip function, so all folders inside zip are created in cur…

8196b38

…rent /tmp sub folder instead of cwd Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

check for files to skip before creating the dir and add __MACOSX to s…

067a69f

…kipped file Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

fix Zip Slip attack and add test

494fe1e

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

add test that fail for old function

f177806

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

add test that fail for old function

9002212

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

add test that fail for old function

d3cd80e

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

muhammadolammi force-pushed the fix/utils-ExtractZip branch from 9dde1d5 to d3cd80e Compare January 3, 2026 11:27

make err a mesherror

fb4ff3d

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

muhammadolammi force-pushed the fix/utils-ExtractZip branch from 27f6546 to fb4ff3d Compare January 3, 2026 12:11

muhammadolammi mentioned this pull request Jan 3, 2026

feat: implement recursive CRD discovery and robust GitHub URL parsing #887

Open

1 task

parthivsaikia reviewed Jan 7, 2026

View reviewed changes

utils/zip_test.go Outdated Show resolved Hide resolved

parthivsaikia reviewed Jan 7, 2026

View reviewed changes

utils/zip_test.go Show resolved Hide resolved

lekaf974 reviewed Jan 9, 2026

View reviewed changes

lekaf974 requested changes Jan 9, 2026

View reviewed changes

muhammadolammi force-pushed the fix/utils-ExtractZip branch from 05fee38 to 9b3ddae Compare January 9, 2026 18:19

update test

65937b7

Signed-off-by: Muhammad Akewukanwo <muhammadolammi@gmail.com>

muhammadolammi force-pushed the fix/utils-ExtractZip branch from 9b3ddae to 65937b7 Compare January 9, 2026 18:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Fix/utils extract zip#885

Fix/utils extract zip#885
muhammadolammi wants to merge 8 commits intomeshery:masterfrom
muhammadolammi:fix/utils-ExtractZip

muhammadolammi commented Jan 3, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Jan 3, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

leecalcote commented Jan 7, 2026

Uh oh!

Uh oh!

Uh oh!

lekaf974 Jan 9, 2026

Uh oh!

lekaf974 Jan 9, 2026

Uh oh!

lekaf974 left a comment •

edited

Loading

Uh oh!

muhammadolammi commented Jan 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

Conversation

muhammadolammi commented Jan 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Jan 3, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

leecalcote commented Jan 7, 2026

Uh oh!

Uh oh!

Uh oh!

lekaf974 Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

lekaf974 Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

lekaf974 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

muhammadolammi commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

muhammadolammi commented Jan 3, 2026 •

edited

Loading

lekaf974 left a comment •

edited

Loading

muhammadolammi commented Jan 9, 2026 •

edited

Loading