Summary

WriteAllToDisk() rejects filenames containing .. (added in commit 3bf2b07b2a77c8c8840031a3ef5867acf1b97f30), but WriteAllToZip() has no equivalent check. This allows a plugin to produce .zip/.jar/.srcjar archives containing path traversal entries like ../../PWNED.txt.

Affected File

src/google/protobuf/compiler/command_line_interface.cc

Current Behavior

WriteAllToDisk() — protected:

if (absl::StrContains(filename, "..")) {
  // error: Output file names must never have a relative path.
}

WriteAllToZip() — no equivalent check exists

Steps to Reproduce

# Plugin that returns traversal filename
f.name = "../../PWNED.txt"

# Directory output (correctly blocked)
# Output file names must never have a relative path. (../../PWNED.txt)

# Archive output (NOT blocked)
unzip -Z -1 out.zip
# ../../PWNED.txt  ← traversal entry present in archive

Expected Behavior

Same traversal rejection in WriteAllToZip() as in WriteAllToDisk()

Suggested Fix

Apply identical .. guard inside WriteAllToZip() and add parity unit tests mirroring existing RejectDotDotInFilename tests for zip/jar/srcjar output modes.

Note

This was reported privately to Google Security and they confirmed it is not a security bug but suggested opening a public GitHub issue for tracking.