Add Zip Archives password support#122093
Open
alinpahontu2912 wants to merge 102 commits into
Open
Conversation
…assword and unprotected
… with cryptography lib
This was referenced Dec 2, 2025
Open
This was referenced Jun 26, 2026
rzikm
approved these changes
Jun 29, 2026
rzikm
left a comment
rzikm
left a comment
Member
There was a problem hiding this comment.
LGTM, few ideas for making the code cleaner.
MihaZupan
reviewed
Jun 29, 2026
Member
|
@alinpahontu2912 We signed off earlier this week on the security design you submitted. Thanks. :) Remember to update the public-facing docs so that consumers know what explicit promises (and non-promises!) the component intends to make here. |
bartonjs
reviewed
Jul 2, 2026
bartonjs
reviewed
Jul 6, 2026
Comment on lines
+47
to
+48
| } | ||
| return WinZipAesKeyMaterial.GetSaltSize(keySizeBits); |
Member
There was a problem hiding this comment.
Suggested change
| } | |
| return WinZipAesKeyMaterial.GetSaltSize(keySizeBits); | |
| } | |
| return WinZipAesKeyMaterial.GetSaltSize(keySizeBits); |
bartonjs
reviewed
Jul 6, 2026
Comment on lines
+68
to
+72
| if (OperatingSystem.IsBrowser()) | ||
| { | ||
| throw new PlatformNotSupportedException(SR.WinZipEncryptionNotSupportedOnBrowser); | ||
| } | ||
| ArgumentNullException.ThrowIfNull(baseStream); |
Member
There was a problem hiding this comment.
Either a blank line after the close curly (to match the rest of the file style) or move this if/throw to a helper.
Suggested change
| if (OperatingSystem.IsBrowser()) | |
| { | |
| throw new PlatformNotSupportedException(SR.WinZipEncryptionNotSupportedOnBrowser); | |
| } | |
| ArgumentNullException.ThrowIfNull(baseStream); | |
| if (OperatingSystem.IsBrowser()) | |
| { | |
| throw new PlatformNotSupportedException(SR.WinZipEncryptionNotSupportedOnBrowser); | |
| } | |
| ArgumentNullException.ThrowIfNull(baseStream); |
or
Suggested change
| if (OperatingSystem.IsBrowser()) | |
| { | |
| throw new PlatformNotSupportedException(SR.WinZipEncryptionNotSupportedOnBrowser); | |
| } | |
| ArgumentNullException.ThrowIfNull(baseStream); | |
| CheckPlatformSupport(); | |
| ArgumentNullException.ThrowIfNull(baseStream); |
bartonjs
reviewed
Jul 6, 2026
bartonjs
left a comment
bartonjs
left a comment
Member
There was a problem hiding this comment.
I never looked at the tests at all.
I skimmed the majority of the source code looking for places where the password might be mishandled.
I aggressively reviewed the crypto parts of WinZipAesStream and ZipCryptoStream.
Those parts LGTM.
Since I didn't do a full review I won't give a checkmark, but I also don't have any reason to hold.
Comment on lines
+178
to
+181
| public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.IO.FileAccess access, System.ReadOnlySpan<char> password, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; } | ||
| public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.IO.FileAccess access, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; } | ||
| public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.ReadOnlySpan<char> password, System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; } | ||
| public System.Threading.Tasks.Task<System.IO.Stream> OpenAsync(System.Threading.CancellationToken cancellationToken = default(System.Threading.CancellationToken)) { throw null; } |
Comment on lines
+689
to
+693
| ZipArchiveEntry lastEntry = _entries[_entries.Count - 1]; | ||
| if (lastEntry.IsEncrypted) | ||
| { | ||
| lastEntry.ReadEncryptionSaltIfNeeded(); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1545
Big Milestones and status: