Test files › Folders and paths › separator-confusion.zip
Sample ZIP file (separator confusion)
Entry names containing a literal backslash, a doubled slash, a "." segment and a trailing-slash file, all of which are legal bytes that extractors interpret differently.
↓ Download separator-confusion.zip| Filename | separator-confusion.zip |
| Format | ZIP |
| Size | 662 bytes (662 bytes) |
| MIME type | application/zip |
| SHA-256 | 478fc2728e7182256dee9406fc5deb8a4f940b6ad1d5846799cd6a24f2a8f8bc |
What this file catchesSeparator handling. The ZIP spec makes "/" the only separator, so the backslash entry is one file whose name contains a backslash. Many extractors, including Python zipfile, treat it as a separator and hand you a directory instead. The doubled slash and the "." segment are the ones that let a path-traversal check be bypassed by normalising after validating rather than before.
Download & verify
curl -fsSL -o "separator-confusion.zip" "https://files.hexaqa.com/folder/separator-confusion.zip"
curl -fsSL "https://files.hexaqa.com/folder/separator-confusion.zip" | sha256sum
# expect: 478fc2728e7182256dee9406fc5deb8a4f940b6ad1d5846799cd6a24f2a8f8bc