I am creating a program that allows for user modifications and I want users to be able to share these modifications with each other.
I am taking steps to try to reduce the dangers with regards to scripting (using a language with sandboxing capabilities to disallow e.g. filesystem access), but there's another concern I'm not sure how to address:
I am under the impression that common archive file formats are not safe to use.
For instance, compression formats allow stuff like zip bombs. That problem, at least, could maybe be avoided by using a format that doesn't allow compression, or one that does but can be configured not to and produces files that can be checked for compression and treated as invalid if they are compressed.
I also don't know how serious a concern zip bombs are in this use case; they might be annoying, but the user would just see what happened and delete the contents. My thought is that zip bombs are more of a concern for servers and the like, as they could be used to consume resources in a denial of service attack - am I right about that?
However, even if zip bombs aren't a real concern, I believe there is a concern that is real: links
My understanding is that an archive could be made that contains a link to an area of the filesystem outside of the archive. It seems to me like this could allow access to files that shouldn't be accessed, or other nefarious stuff along those lines; for instance, deleting the modification could end up deleting a linked file?
My initial thought was to just check all files and directories in the archives to see if they are links or just normal, but I don't see any way to do this in .NET; or rather, System.FileSystemInfo.LinkTarget and System.FileSystemInfo.ResolveLinkTarget exist, however they only seem to exist in .NET 6 and up, and I currently am stuck using netstandard 2.1.
Even if those methods were available, I'm not sure if they detect all types of links that I would have to be concerned about (their documentation states that they can resolve symbolic links and junctions, which implies there are other types of links they cannot resolve, though I'm not sure what those might be or if I need to care about them); it may be relevant to mention that I am supporting both Windows and Linux.
I am considering if I should create my own archive file format that tries to answer these concerns, but even this seems dangerous; I had considered using a serialization library like MessagePack, but the documentation for that introduced me to the dangers of deserializing user-supplied data.
So I am wondering what my options are?
What are some approaches to this problem?
Are there any archive file formats that would not allow for anything dangerous to be done?
Or is this not a real danger and am I wrong to be concerned about this?