i'm surprised they need to be handcrafted. the zip that ships with OSX will let you create such 'bad' archives. tar will also let you create 'bad' archives. and

i'm surprised they need to be handcrafted. the zip that ships with OSX will let you create such 'bad' archives. tar will also let you create 'bad' archives. and interestingly enough tar on OSX will barf if you try to extract any of these 'bad' archives. also, there is another trick you can do with tar archives which is not possible for zip archives which is embed a symlink into the archive that points outside the archive and trick the tar program into following the symlink. the tar that ships with OSX will barf on this (even if it wasn't responsible for creating the symlink) but i know on other platforms tar will happily extract through symlinks. i know because there was one PaaS platform where you could extract though symlinks to break out of their sandbox. also, zip will extract through symlinks because it doesn't really understand symlinks. EDIT: (zip understands symlinks. the default OSX version will defer making the symlinks until other files are unzipped which fixes symlinks being used from escaping) > zip my.zip ../foo.txt adding: ../foo.txt (stored 0%) > unzip -l my.zip Archive: my.zip Length Date Time Name --------- ---------- ----- ---- 4 06-05-2018 15:08 ../foo.txt --------- ------- 4 1 file > unzip my.zip Archive: my.zip warning: skipped "../" path component(s) in ../foo.txt extracting: foo.txt > zip my.zip outside/foo.txt adding: outside/foo.txt (stored 0%) > rm outside/foo.txt > unzip my.zip Archive: my.zip extracting: outside/foo.txt > cat ../foo.txt foo > tar cvf my_tar ../foo.txt a ../foo.txt > tar tvf my_tar.tar -rw-r--r-- 0 benmurphy wheel 4 5 Jun 15:00 ../foo.txt > tar xvf my_tar.tar x ../foo.txt: Path contains '..' tar: Error exit delayed from previous errors. > ln -s ../ outside > tar cvf my_tar.tar outside outside/foo.txt a outside a outside/foo.txt > tar tvf my_tar.tar lrwxr-xr-x 0 benmurphy wheel 0 5 Jun 15:01 outside -> ../ -rw-r--r-- 0 benmurphy wheel 4 5 Jun 15:02 outside/foo.txt > tar xvf my_tar.tar x outside x outside/foo.txt: Cannot extract through symlink outside/foo.txt tar: Error exit delayed from previous errors.