BugReportTool: replace cziplib with tar.exe (#41127)
BugReportTool is the last consumer in the PowerToys repo of cziplib, a library we use to produce ZIP files. This pull request replaces cziplib with a simple CreateProcess call that spawns `tar.exe`, which comes with Windows as of RS4 and can produce ZIP files! I've tested this by producing a bug report archive and attempting to open it with File Explorer. It works fine. We have taken every precaution to ensure that we do not allow any attacker-controlled input to tar's command line. We are *not* using `system()`, and we are not opening up a vector through which a nefarious caller can perform shell injection. We do not pass filenames to tar except that of the final archive. We do not pass directory names to tar; we rely on the current directory instead.
D
Dustin L. Howett committed
193d9aacbe78a7c284d00fb59a2d8b052b7eebf5
Parent: 483e773
Committed by GitHub <[email protected]>
on 11/13/2025, 11:59:21 PM