archive/zip: Reader.Open panics on empty string [1.16 backport]

[gopherbot]

@FiloSottile requested issue #48085 to be considered for backport to the next 1.16 minor release.

Thank you for reporting this to [email protected]. Invalid input should not cause programs to panic, if the input could be attacker controlled. If this required a call to Open("") to trigger, it could have been borderline, since it's hard for an attacker to control the argument to Open. However, the reproducer in #48085 (comment) triggers a panic with a real file name.

package main

import "archive/zip"

func main() {
	reader, err := zip.OpenReader("liquibase-core-4.4.3-sources.zip")
	if err != nil {
		panic(err)
	}

	reader.Open("META-INF/MANIFEST.MF")
}

We'll backport this as a security fix in the PUBLIC track. @gopherbot, please open backport issues.

[gopherbot]

Change https://golang.org/cl/360858 mentions this issue: [release-branch.go1.16] archive/zip: don't panic on (*Reader).Open

[gopherbot]

Closed by merging 88407a8 to release-branch.go1.16.