Path traversal outside the extraction root

Rule ID: security.path-traversal@1.0.0. Availability below refers to source-scan at product 524fa07e.

V-SEC-06 — Path traversal outside the extraction root#

Path traversal outside the extraction root. It examines trust boundaries, sensitive flows, validation, and security-sensitive effects.

Availability#

Not available in source-scan. There is no source-scan flag to activate this condition.

Example and action#

Illustrative design scenario, not a runnable Swift example or a reproduced analyzer result. The stated availability and evidence boundaries still apply.

Before: An archive entry such as ../outside.txt is joined to an extraction root without validating its destination.

Review the following change against the contract and build variants described above.

After: Use an extraction policy that rejects escaping paths and handles symlinks and path races. Validate the actual destination at the write boundary; a string-prefix comparison alone is insufficient.

Intended analysis#

Intended reasoning: Relate the selected security contract to a source, transformation and sensitive operation. The intended check requires identity, flow and policy evidence; a suspicious API name alone does not establish exploitation. Required evidence: source, sink, trust, policy, validation, and flow facts

Assumptions and unknown#

The relevant facts must be admitted for the selected immutable build world. Unknown aliases, external effects, unsupported source forms or incomplete consumers can prevent a conclusion. Availability in this workflow is stated above; the illustration does not expand that availability.

Evidence and interpretation#

The target catalog describes the intended condition. It is not evidence of an active source-scan diagnostic.

Historical evidence at 4558458d: recovery-required (historical qualification is incomplete and needs further evidence). That evidence has not been requalified for this product revision.

How we validate checks explains the evidence boundary. Foundations separates method assumptions from implementation claims.