CVE-2023-28105 (Go, published 2023-03-16T17:15Z)
Description: value: go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/dablelv/go-huge-util
Files changed:
README.md
file/file.go
zip/unzip.go
zip/zip.go
Commit message: fix zip.Unzip path traversal vulnerability and add some new file utility functions


Vulnerable code:
# JSON

Some converting function to json.
student := struct {
    Hobby   string
    Age     int32
}{
    Hobby: "pingpopng",
    Age:   28,
}
encoding.ToIndentJSON(&student)
/*
output:
{
    "Hobby": "pingpopng",
    "Age": 28
}
*/
// ListDir lists all the file or dir names in the specified directory.
// IsPathExist checks whether a file/dir exists.
func IsPathExist(path string) (bool, error) {
// IsSymlink checks a file whether is a symbolic link.
// IsSymlinkE checks a file whether is a symbolic link.
// https://gist.github.com/novalagung/13c5c8f4d30e0c4bff27
	err := os.Remove(path)
	return err
// If the parent directory does not exist, it will be created with mode os.ModePerm.is cr truncated.
// If successful, methods on the returned File can be used for I/O; the associated file descriptor has mode O_RDWR.
func Create(filePath string) (*os.File, error) {
	if exist, err := IsPathExist(filePath); err != nil {
	} else if exist {
		return os.Create(filePath)
	if err := os.MkdirAll(filepath.Dir(filePath), os.ModePerm); err != nil {
	return os.Create(filePath)
// BytesToFile writes data to a file. If the file does not exist it will be created with permission mode 0644.
func BytesToFile(filePath string, data []byte) error {
	exist, _ := IsPathExist(filePath)
		if err := CreateFile(filePath); err != nil {
	return ioutil.WriteFile(filePath, data, 0644)
	// create the directory of file
	filePath := path.Join(dstDir, file.Name)
	// open the file
	// create the file
	// save the decompressed file content
// Note that if a file is a symbolic link it will be skipped.

Fixed code:
Some converting function to json.
```go
student := struct {
    Hobby   string
    Age     int32
}{
    Hobby: "pingpopng",
    Age:   28,
}
encoding.ToIndentJSON(&student)
/*
output:
{
    "Hobby": "pingpopng",
    "Age": 28
}
*/
```
# File
// ListDir lists all the file or directory names in the specified directory.
ListDir()

// IsExist checks whether a file/dir exists.
IsExist()

// IsDir checks whether a path is a directory.
IsDir()
IsDirE()

// IsFile checks whether a path is a file.
IsFile()
IsFileE()

// IsSymlink checks a file whether is a symbolic link file on Linux.
IsSymlink()
IsSymlinkE()

// IsShortcut checks a file whether is a shortcut on Windows. 
IsShortcutFile()

// Create a file.
Create()
CreateFile()

// ClearFile clears a file content.
ClearFile()

// ...
// ListDir lists all the file or directory names in the specified directory.
// IsExist checks whether a file/dir exists.
func IsExist(path string) (bool, error) {
// IsSymlink checks a file whether is a symbolic link on Linux.
// If you want to check a file whether is a shortcut file on Windows please use IsShortcut function.
// IsSymlinkE checks a file whether is a symbolic link on Linux.
// If you want to check a file whether is a shortcut file on Windows please use IsShortcut function.
// IsShortcut checks a file whether is a shortcut on Windows.
func IsShortcut(path string) bool {
	ext := filepath.Ext(path)
	if ext == ".lnk" {
		return true
	}
	return false
}

// If there is an error, it will be of type *PathError.
	return os.Remove(path)
// If the parent directory does not exist, it will be created with mode os.ModePerm.
// If successful, methods on the returned file can be used for I/O; the associated file descriptor has mode O_RDWR.
func Create(path string) (*os.File, error) {
	exist, err := IsExist(path)
	if err != nil {
	if exist {
		return os.Create(path)
	}
	if err := os.MkdirAll(filepath.Dir(path), os.ModePerm); err != nil {
	return os.Create(path)
// BytesToFile writes data to a file.
// If the file does not exist it will be created with permission mode 0644.
func BytesToFile(path string, data []byte) error {
	exist, _ := IsExist(path)
		if err := CreateFile(path); err != nil {
	return ioutil.WriteFile(path, data, 0644)

// ClearFile clears a file content.
func ClearFile(path string) error {
	f, err := os.OpenFile(path, os.O_WRONLY|os.O_TRUNC, 0777)
	if err != nil {
		return err
	}
	defer f.Close()
	return nil
}
	"strings"
	// Prevent path traversal vulnerability.
	// Such as if the file name is "../../../path/to/file.txt" which will be cleaned to "path/to/file.txt".
	name := strings.TrimPrefix(filepath.Join(string(filepath.Separator), file.Name), string(filepath.Separator))
	filePath := path.Join(dstDir, name)

	// Create the directory of file.
	// Open the file.
	// Create the file.
	// Save the decompressed file content.
// Note that if a file is a symbolic link on Linux it will be skipped.
// If you want to follow a symbolic link please use the function ZipFollowSymlink.