Skip to content

exported zip has extra leading slash -> absolute paths in zip #194

Description

@thorinaboenke

Subject of the issue

The library's _save_to_bytes() (in DetectMateLibrary/src/detectmatelibrary/utils/persistency/persistency_saver.py) has an off-by-one when stripping the root prefix from fsspec MemoryFileSystem paths (paths start with /, file_path[len(root)+1:] leaves a stray leading slash.
The zip then contains /metadata.json and /events/1.msgpack instead of metadata.json and events/1.msgpack.

The library's own _load_from_bytes tolerates this (path joining absorbs the extra slash)
but if you download and then unzip you get absolute paths inside a zip (no valid archive layout)

Your environment

  • Version of detectmate
  • Version of python
  • Docker or manual installation?

Steps to reproduce

from detectmatelibrary.detectors.new_value_detector import NewValueDetector, NewValueDetectorConfig

det = NewValueDetector(name="Demo", config=NewValueDetectorConfig(auto_config=False))
det.persistency.ingest_event(event_id=1, event_template="login <*>", named_variables={"user": "alice"})

data = det.export_state()   # bytes, no path given

import zipfile, io
with zipfile.ZipFile(io.BytesIO(data)) as zf:
    print(zf.namelist())

open("/tmp/demo_state.zip", "wb").write(data)

output:

['/events/1.msgpack', '/metadata.json']

unzip -l /tmp/demo_state.zip

Image

Expected behaviour

zip file should not contains files or folders with leading slashes

Actual behaviour

zip file has files or folders with leading slashes

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions