New PeaZip fails to extract .PEA file
Free Zip software and Rar extractor
Brought to you by:
giorgiotani
Menu
▾
▴
#924 New PeaZip fails to extract .PEA file
Six years ago, I have created a .PEA file protected by a password. I tried to open it today with PeaZip 11.2.0 Flatpak and got an error message: "Relative filenames not supported". It's the first time I wasn't able to extract this file. Fortunately, I have "peazip_portable-10.2.0.WIN64" on my windows machine, and it extracted the .PEA file without any problem.
Starting from 10.1.0 release PeaZip is set to refuse relative filenames in .PEA archives (both for archive creation and extraction) to fix a path traversal vulnerability https://sourceforge.net/p/peazip/tickets/914/
The anomaly is that the Linux version produces this specific error message, while the Windows version does not.
If you can provide a sample archive with this defect I'll be glad to retest the implementation to better understand the issue - if the error is improperly triggered, or if it is mishandled in some specific instances.
I can't send you this file because it has my personal information. I will perform some tests later and maybe send you a different file.
I think you are mistaken. The link you provided talks about version 11.1.0 and not 10.1.0. I think this is important because I was able to extract the file in 10.2.0, and my intuition tells me the fix introduced in 11.1.0 broke something, and that's why I was able to extract it in an older version of the program.
I'm not a programmer. Please, explain to me what are "Relative filenames". The archived file's name contains numbers and underscores.
You are right "10.1.0" is a typo, the updated version is the 11.1.0 as per ticket 914.
From this release onward .pea requires filenames being absolute, not relative (for a brief explanation about relative filenames see in example https://www.redhat.com/en/blog/linux-path-absolute-relative ).
Previous versions can extract archives created with relative filenames - which however should not happen to be created through the GUI, only from command line.
Current versions neither allow creation nor extraction of archives containing relative paths to prevent any potential abuse of relative paths to attempt path traversal, a type of attack applying to archive and container formats in which a purposely crafted path evades planned safety checks to have some content extracted to unexpected locations in the host system.
I've read about relative filenames and I fail to see how is it relevant in my situation? I'm trying to extract a single file. I've never used PeaZip in command line.
I did some testing, and now I think the problem might be with flatpak version, because both older and the newest version of PeaZip on Windows work fine.
I have extracted the file in the older version and archived it in .PEA file protected by a password like before, but in the newest PeaZip; however, on Linux the problem prevails.
I've made a test file on windows in the newest version and when I made an attempt to extract it on Linux I get "Relative filenames not supported". I attach the test file. Password is: test
I hope this helps
Thank you for the feedback.
I've been able to replicate the issue and I'm working on a fix.