Is there any client side validation for handling security in zip file upload ( zip slip vulnerability ) while uploading zip files ?

[Ranjith]

ZIP Slip makes the application vulnerable to Path traversal attack and Sensitive data exposure.

[Silviya]

Hi Ranjith,

The Upload component does not support built-in security checks. What I can suggest in this situation is a using a third-party library to validate the selected files. The Upload component triggers a SelectEvent whenever a file is being selected. This event could be utilised to access and process the selected files (including the underlying raw file) on the client side.

https://www.telerik.com/kendo-angular-ui/components/uploads/api/SelectEvent/

https://www.telerik.com/kendo-angular-ui/components/uploads/api/FileInfo/#toc-rawfile

It would take an event binding in the component declaration:

<kendo-upload
      [saveUrl]="uploadSaveUrl"
      [removeUrl]="uploadRemoveUrl"
      (select)="onSelect($event)"
>

public onSelect(ev: SelectEvent): void {​ 
  ev.files.forEach((file: FileInfo) => {​
    if (file.rawFile) {​ ...
      ...
  }​); 
}​

An example implementation of processing selected files on the client side can be found in the following How-To:

https://www.telerik.com/kendo-angular-ui/components/uploads/upload/how-to/local-file-processing/

I hope this information helps. Let me know if I could provide further assistance regarding the case.

Regards,
Silviya
Progress Telerik

[Ranjith]

Hi Silviya

Let me check.. Thanks for your response.