Test files › Folders and paths › separator-confusion.zip

Sample ZIP file (separator confusion)

Entry names containing a literal backslash, a doubled slash, a "." segment and a trailing-slash file, all of which are legal bytes that extractors interpret differently.

↓ Download separator-confusion.zip
Filenameseparator-confusion.zip
FormatZIP
Size662 bytes (662 bytes)
MIME typeapplication/zip
SHA-256478fc2728e7182256dee9406fc5deb8a4f940b6ad1d5846799cd6a24f2a8f8bc
What this file catchesSeparator handling. The ZIP spec makes "/" the only separator, so the backslash entry is one file whose name contains a backslash. Many extractors, including Python zipfile, treat it as a separator and hand you a directory instead. The doubled slash and the "." segment are the ones that let a path-traversal check be bypassed by normalising after validating rather than before.

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Check an archive's paths before extracting it on another system. Windows reserves device names, drops trailing dots and spaces, and treats \ as a separator; Windows and macOS compare names without case, so two folders that differ only in case merge. Use orig_filename: on Windows, zipfile quietly turns backslashes into slashes.

import unicodedata
import zipfile

RESERVED = {"CON", "PRN", "AUX", "NUL"} | {f"{d}{i}" for d in ("COM", "LPT") for i in range(1, 10)}
LONG = 200  # leaves room for the folder it is extracted into, under Windows' classic 260

def problems(names):
    paths = {}  # every entry and every parent folder, in order
    for name in names:
        parts = name.rstrip("/").split("/")
        for i in range(len(parts)):
            paths.setdefault("/".join(parts[:i + 1]), parts[i])
    for path, part in paths.items():
        if "\\" in part:
            yield f"{path!r}: a backslash is a folder separator on Windows"
        if part in ("", "."):
            yield f"{path!r}: empty or '.' segment"
        elif part.split(".")[0].upper() in RESERVED:
            yield f"{path!r}: {part} is a reserved device name on Windows"
        elif part != part.rstrip(". "):
            yield f"{path!r}: ends in a dot or space, which Windows drops"
        if unicodedata.normalize("NFC", part) != part:
            yield f"{ascii(path)}: not NFC-normalised, so it may not match the same name typed elsewhere"
    groups = {}
    for path in paths:
        groups.setdefault(unicodedata.normalize("NFC", path).casefold(), []).append(path)
    for same in groups.values():
        if len(same) > 1:
            yield " and ".join(map(repr, same)) + ": the same path on Windows and macOS"
    longest = max(names, key=len, default="")
    if len(longest) > LONG:
        yield f"longest entry is {len(longest)} characters: extracted into any folder, it passes the 260-character limit"

with zipfile.ZipFile("separator-confusion.zip") as z:
    names = [info.orig_filename for info in z.infolist()]
found = list(problems(names))
print(f"{len(names)} entries: " + (f"{len(found)} portability problem{'s' * (len(found) != 1)}" if found else "portable"))
for p in found:
    print("  " + p)

Run against this file, it prints: 4 entries: 3 portability problems 'literal\\backslash.txt': a backslash is a folder separator on Windows 'double/': empty or '.' segment 'dot/.': empty or '.' segment

Related guides and tools

Sample ZIP fileFilename compatibilityFile systemsCheck a file's real typeVerify its SHA-256

Download & verify

curl -fsSL -o "separator-confusion.zip" "https://files.hexaqa.com/folder/separator-confusion.zip"
curl -fsSL "https://files.hexaqa.com/folder/separator-confusion.zip" | sha256sum # expect: 478fc2728e7182256dee9406fc5deb8a4f940b6ad1d5846799cd6a24f2a8f8bc

More folders and paths test files

case-collision-dirs.zipdeep-path-over-260.zipempty-directory.zipexplicit-dir-entries.zipreserved-and-awkward-dirs.zipunicode-dir-names.zip

← All Folders and paths files