Add Zip Archives password support by alinpahontu2912 · Pull Request #122093 · dotnet/runtime

alinpahontu2912 · Dec 2, 2025

Fixes #1545

Big Milestones and status:

Read Encrypted Entries (ZipCrypto, WinZip AES)
Create Encrypted Entries (ZipCrypto, Winzip AES)
Update Mode
Add runtime assets for checking compat with WinRar/7zip/WinZip/etc
Security check for Cryptography methods
Final API design

…assword and unprotected

… with cryptography lib

Copilot

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 4 comments.

Lifting hold.

GrabYourPitchforks · Jul 2, 2026

@alinpahontu2912 We signed off earlier this week on the security design you submitted. Thanks. :)

Remember to update the public-facing docs so that consumers know what explicit promises (and non-promises!) the component intends to make here.

bartonjs

I never looked at the tests at all.

I skimmed the majority of the source code looking for places where the password might be mishandled.

I aggressively reviewed the crypto parts of WinZipAesStream and ZipCryptoStream.

Those parts LGTM.

Since I didn't do a full review I won't give a checkmark, but I also don't have any reason to hold.

Copilot

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 2 comments.

…WinZipAesStream.cs Co-authored-by: Jeremy Barton <jbarton@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 42 out of 42 changed files in this pull request and generated 4 comments.

rzikm

LGTM, great work!

MihaZupan · Jul 14, 2026

@alinpahontu2912 did you test running the new fuzzers locally?
They're failing to build in CI due to missing corpus files that you've referenced

alinpahontu2912 added 22 commits October 20, 2025 15:38

working zipcrypto, hardcoded password

527c698

add tests with multiple entries with same password and entries with p…

255642b

…assword and unprotected

reading/extracting experimentation and tests

968bb60

add enum for encryption and write methods for zipcrypto stream

19cbc8e

allow encryption of entries

0dec737

add more read/write tests for update mode and small refactors

f30fbfb

add default password and encryption method to ziparchive

aac140b

avoid ambigous calls

eb1a460

avoid ambigous calls and fi some nitpicks

0a7c885

recognize aes encrypted files + build fais due to circular dependency…

817165c

… with cryptography lib

fixed some comments

797921d

remove storing password fields

623f238

initial reading of winzip encrypted files

b61b37c

address zipcrypto comments

122f85a

initial writing test works

55c0613

add more tests for winzipaesstream and work on async methods

cc6d30d

Merge remote-tracking branch 'upstream/main' into zip_password

b056780

async methods done, fix ae-1 validation and add more tests

6732696

Solve some comments

8efa772

refactor tests and ci disable local ones

d5bb294

improve winzipaesstream writing by generating larger keystream

0c659fc

update tests, fixed async opening and updated stream positioning

e2b21ff

github-actions Bot added the area-System.IO.Compression label Dec 2, 2025

dotnet-policy-service Bot assigned alinpahontu2912 Dec 2, 2025

Merge branch 'main' into zip_password

dbcee70

rzikm self-requested a review December 11, 2025 12:22

Merge branch 'main' into zip_password

ff9160b

alinpahontu2912 added 2 commits June 30, 2026 15:23

solve comments

2f5458f

fix wasm/wasi tests

3174d46

Copilot AI review requested due to automatic review settings July 1, 2026 07:36

Copilot started reviewing on behalf of alinpahontu2912 July 1, 2026 07:36 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

bartonjs reviewed Jul 2, 2026

View reviewed changes

address comments

d77b9af

alinpahontu2912 requested a review from bartonjs July 3, 2026 09:56

build-analysis Bot mentioned this pull request Jul 3, 2026

OverlappingExtensions_AllMatchTypes_Comprehensive failing on Assert.DoesNotContain #128907

Open

bartonjs reviewed Jul 6, 2026

View reviewed changes

Comment thread src/libraries/System.IO.Compression/src/System/IO/Compression/WinZipAesStream.cs

bartonjs reviewed Jul 6, 2026

View reviewed changes

Comment thread src/libraries/System.IO.Compression/src/System/IO/Compression/WinZipAesStream.cs

bartonjs reviewed Jul 6, 2026

View reviewed changes

fix wasm failure

6e036ab

Copilot AI review requested due to automatic review settings July 7, 2026 07:47

Copilot AI reviewed Jul 7, 2026

View reviewed changes

Comment thread src/libraries/System.IO.Compression/ref/System.IO.Compression.cs

Comment thread src/libraries/System.IO.Compression/src/System/IO/Compression/ZipArchive.cs

This was referenced Jul 7, 2026

System.Threading.Tasks.Tests.AsyncProfilerTests.StateMachineAsync_CallstackStressWithVaryingDepths test failure #129871

Closed

[ci-scan] Test failure: AsyncProfilerTests.StateMachineAsync_CallstackStressWithVaryingDepths under libraries-jitstress #129938

Closed

alinpahontu2912 and others added 2 commits July 7, 2026 13:31

add guards for unsupported tests

4e1d41a

Update src/libraries/System.IO.Compression/src/System/IO/Compression/…

2b3e067

…WinZipAesStream.cs Co-authored-by: Jeremy Barton <jbarton@microsoft.com>

Copilot AI reviewed Jul 7, 2026

View reviewed changes

rzikm approved these changes Jul 9, 2026

View reviewed changes

dotnet-maestro Bot mentioned this pull request Jul 10, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#7617

Merged

pavelsavara mentioned this pull request Jul 13, 2026

[wasm] Fix ReferenceNewAssembly rebuild test: driver-gen.c regeneration and stale-native comparison #130616

Merged

This was referenced Jul 13, 2026

[wasm] System.IO.Compression roots System.Security.Cryptography into every trimmed app using ZipArchive (size regression from #122093) #130650

Open

[wasm] Harden ReferenceNewAssemblyRebuildTest against dependency-closure changes #130655

Closed

MihaZupan mentioned this pull request Jul 20, 2026

Revert WinZipAesStreamFuzzer, ZipCryptoStreamFuzzer #131075

Merged

alinpahontu2912 mentioned this pull request Jul 21, 2026

Avoid rooting cryptography through ZipArchive on browser #130688

Open

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

alinpahontu2912 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GrabYourPitchforks commented Jul 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bartonjs left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rzikm left a comment

Choose a reason for hiding this comment

Uh oh!

MihaZupan commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

alinpahontu2912 commented Dec 2, 2025 •

edited

Loading