mirror of
https://github.com/microsoft/PowerToys.git
synced 2025-12-10 00:47:58 -06:00
BugReportTool is the last consumer in the PowerToys repo of cziplib, a library we use to produce ZIP files. This pull request replaces cziplib with a simple CreateProcess call that spawns `tar.exe`, which comes with Windows as of RS4 and can produce ZIP files! I've tested this by producing a bug report archive and attempting to open it with File Explorer. It works fine. We have taken every precaution to ensure that we do not allow any attacker-controlled input to tar's command line. We are *not* using `system()`, and we are not opening up a vector through which a nefarious caller can perform shell injection. We do not pass filenames to tar except that of the final archive. We do not pass directory names to tar; we rely on the current directory instead.