SIGN IN SIGN UP
microsoft / PowerToys UNCLAIMED

Microsoft PowerToys is a collection of utilities that supercharge productivity and customization on Windows

BugReportTool: replace cziplib with tar.exe (#41127)

BugReportTool is the last consumer in the PowerToys repo of cziplib, a
library we use to produce ZIP files.

This pull request replaces cziplib with a simple CreateProcess call that
spawns `tar.exe`, which comes with Windows as of RS4 and can produce ZIP
files!

I've tested this by producing a bug report archive and attempting to
open it with File Explorer. It works fine.

We have taken every precaution to ensure that we do not allow any
attacker-controlled input to tar's command line. We are *not* using
`system()`, and we are not opening up a vector through which a nefarious
caller can perform shell injection.

We do not pass filenames to tar except that of the final archive. We do
not pass directory names to tar; we rely on the current directory
instead.
D
Dustin L. Howett committed
193d9aacbe78a7c284d00fb59a2d8b052b7eebf5
Parent: 483e773
Committed by GitHub <[email protected]> on 11/13/2025, 11:59:21 PM