CVE-2024-22405: Insufficient Information (NVD-CWE-noinfo)
value: XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-30T10:15Z
Repository: https://github.com/MacPaw/XADMaster
Language: Objective-C
Files changed: XADArchive.m, XADSimpleUnarchiver.m, XADUnarchiver.h, XADUnarchiver.m
Commit date: 2023-10-10 22:53:05 +0300
Commit message: Make sure that quarantine attribute is applied to all directories, not only in the child ones (#157)


Diff: diff --git a/XADArchive.m b/XADArchive.m
index c17432d..142455b 100644
--- a/XADArchive.m
+++ b/XADArchive.m
@@ -1039,12 +1039,16 @@ -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldCreateDirectory:(NSString *)
 {
 	if(!delegate||[delegate archive:self shouldCreateDirectory:directory]) return YES;
 	else return NO;
 }
 
-
-
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory
+{
+    if(delegate) {
+        [delegate archive:self didCreateDirectory:directory];
+    }
+}
 
 
 //
 // Deprecated
 //
@@ -1145,10 +1149,13 @@ -(BOOL)archiveExtractionShouldStop:(XADArchive *)arc
 { return [delegate archiveExtractionShouldStop:arc]; }
 
 -(BOOL)archive:(XADArchive *)arc shouldCreateDirectory:(NSString *)directory
 { return [delegate archive:arc shouldCreateDirectory:directory]; }
 
+-(void)archive:(XADArchive *)arc didCreateDirectory:(NSString *)directory
+{ [delegate archive:arc didCreateDirectory:directory]; }
+
 -(XADAction)archive:(XADArchive *)arc entry:(int)n collidesWithFile:(NSString *)file newFilename:(NSString **)newname
 { return [delegate archive:arc entry:n collidesWithFile:file newFilename:newname]; }
 
 -(XADAction)archive:(XADArchive *)arc entry:(int)n collidesWithDirectory:(NSString *)file newFilename:(NSString **)newname
 { return [delegate archive:arc entry:n collidesWithDirectory:file newFilename:newname]; }
@@ -1205,10 +1212,11 @@ -(XADAction)archive:(XADArchive *)archive nameDecodingDidFailForEntry:(int)n dat
 	return action;
 }
 
 -(BOOL)archiveExtractionShouldStop:(XADArchive *)archive { return NO; }
 -(BOOL)archive:(XADArchive *)archive shouldCreateDirectory:(NSString *)directory { return YES; }
+-(void)archive:(XADArchive *)archive didCreateDirectory:(NSString *)directory { }
 -(XADAction)archive:(XADArchive *)archive entry:(int)n collidesWithFile:(NSString *)file newFilename:(NSString **)newname { return XADOverwriteAction; }
 -(XADAction)archive:(XADArchive *)archive entry:(int)n collidesWithDirectory:(NSString *)file newFilename:(NSString **)newname { return XADSkipAction; }
 -(XADAction)archive:(XADArchive *)archive creatingDirectoryDidFailForEntry:(int)n { return XADAbortAction; }
 
 -(void)archiveNeedsPassword:(XADArchive *)archive {}
diff --git a/XADSimpleUnarchiver.m b/XADSimpleUnarchiver.m
index c9cd793..6dbf644 100644
--- a/XADSimpleUnarchiver.m
+++ b/XADSimpleUnarchiver.m
@@ -868,10 +868,16 @@ -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractEntryWithDictionary:(NSD
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldCreateDirectory:(NSString *)directory
 {
 	return YES;
 }
 
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory {
+    if(propagatemetadata && metadata) {
+        [XADPlatform writeCloneableMetadata:metadata toPath:directory];
+    }
+}
+
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldDeleteFileAndCreateDirectory:(NSString *)directory
 {
 	// If a resource fork entry for a directory was accidentally extracted
 	// as a file, which can sometimes happen with particularly broken Zip files,
 	// overwrite it.
diff --git a/XADUnarchiver.h b/XADUnarchiver.h
index 18636ea..83978bd 100644
--- a/XADUnarchiver.h
+++ b/XADUnarchiver.h
@@ -118,10 +118,11 @@ outputTarget:(id)target selector:(SEL)sel argument:(id)arg;
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldExtractEntryWithDictionary:(NSDictionary *)dict suggestedPath:(NSString **)pathptr;
 -(void)unarchiver:(XADUnarchiver *)unarchiver willExtractEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path;
 -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path error:(XADError)error;
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldCreateDirectory:(NSString *)directory;
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory;
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldDeleteFileAndCreateDirectory:(NSString *)directory;
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldExtractArchiveEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path;
 -(void)unarchiver:(XADUnarchiver *)unarchiver willExtractArchiveEntryWithDictionary:(NSDictionary *)dict withUnarchiver:(XADUnarchiver *)subunarchiver to:(NSString *)path;
 -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractArchiveEntryWithDictionary:(NSDictionary *)dict withUnarchiver:(XADUnarchiver *)subunarchiver to:(NSString *)path error:(XADError)error;
diff --git a/XADUnarchiver.m b/XADUnarchiver.m
index a1d49fa..3da64cc 100644
--- a/XADUnarchiver.m
+++ b/XADUnarchiver.m
@@ -560,15 +560,25 @@ -(XADError)_ensureDirectoryExists:(NSString *)path
 		}
 	}
 
 	#if MAC_OS_X_VERSION_MIN_REQUIRED>=1050 || __IPHONE_OS_VERSION_MIN_REQUIRED>__IPHONE_2_0
 	if([manager createDirectoryAtPath:path
-	withIntermediateDirectories:NO attributes:nil error:NULL]) return XADNoError;
+          withIntermediateDirectories:NO attributes:nil error:NULL]) {
+        if (delegate) {
+            [delegate unarchiver:self didCreateDirectory:path];
+        }
+        return XADNoError;
+    }
 	#else
-	if([manager createDirectoryAtPath:path attributes:nil]) return XADNoError;
+    if([manager createDirectoryAtPath:path attributes:nil]) {
+        if (delegate) {
+            [delegate unarchiver:self didCreateDirectory:path];
+        }
+        return XADNoError;
+    }
 	#endif
-	else return XADMakeDirectoryError;
+    else return XADMakeDirectoryError;
 }
 
 
 
 -(XADError)runExtractorWithDictionary:(NSDictionary *)dict outputHandle:(CSHandle *)handle
@@ -743,10 +753,11 @@ -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldExtractEntryWithDictionary:(
 
 -(void)unarchiver:(XADUnarchiver *)unarchiver willExtractEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path {}
 -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path error:(XADError)error {}
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldCreateDirectory:(NSString *)directory { return YES; }
+-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory { }
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldDeleteFileAndCreateDirectory:(NSString *)directory { return NO; }
 
 -(BOOL)unarchiver:(XADUnarchiver *)unarchiver shouldExtractArchiveEntryWithDictionary:(NSDictionary *)dict to:(NSString *)path { return NO; }
 -(void)unarchiver:(XADUnarchiver *)unarchiver willExtractArchiveEntryWithDictionary:(NSDictionary *)dict withUnarchiver:(XADUnarchiver *)subunarchiver to:(NSString *)path {}
 -(void)unarchiver:(XADUnarchiver *)unarchiver didExtractArchiveEntryWithDictionary:(NSDictionary *)dict withUnarchiver:(XADUnarchiver *)subunarchiver to:(NSString *)path error:(XADError)error {}

Vulnerable code: 

	withIntermediateDirectories:NO attributes:nil error:NULL]) return XADNoError;
	if([manager createDirectoryAtPath:path attributes:nil]) return XADNoError;
	else return XADMakeDirectoryError;
Fixed code: -(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory
{
    if(delegate) {
        [delegate archive:self didCreateDirectory:directory];
    }
}
-(void)archive:(XADArchive *)arc didCreateDirectory:(NSString *)directory
{ [delegate archive:arc didCreateDirectory:directory]; }

-(void)archive:(XADArchive *)archive didCreateDirectory:(NSString *)directory { }
-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory {
    if(propagatemetadata && metadata) {
        [XADPlatform writeCloneableMetadata:metadata toPath:directory];
    }
}

-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory;
          withIntermediateDirectories:NO attributes:nil error:NULL]) {
        if (delegate) {
            [delegate unarchiver:self didCreateDirectory:path];
        }
        return XADNoError;
    }
    if([manager createDirectoryAtPath:path attributes:nil]) {
        if (delegate) {
            [delegate unarchiver:self didCreateDirectory:path];
        }
        return XADNoError;
    }
    else return XADMakeDirectoryError;
-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory { }