I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the inner files into the customers Records Management system.
Our software is .NET 4.5 on IIS 8.5 and I am just wondering if I should be arranging with management to not approve this request. Ive always been taught to treat .Zip files with suspicion, and the fact that I am going to then pass the trust to the computer to extract, look at the files and then move them scares me quite a bit.
Are my concerns just old news in which I shouldn't be worried anymore, and should I be comfortable enough to trust that IIS and .NET ZIP libraries are not going to end up being caught out by executing some sort of remote code, or migrating a virus through the customers network.
The files are usually uploaded to a file system location until moved to the records system, so potentially having an .exe sitting loosely around the system concerns me (although on extraction could remove specific file types). If I just streamed uploads directly into the Records System would this reduce any risk?
Our current product only allows upload of files with the png, pdf, docx and other image based extensions.
Are my concerns legitimate, or should I be trusting IIS and .NET to handle correctly.
I am also finding it extremely difficult to find information based websites that carry information for specific related concerns for specific technologies (IIS, .NET etc.), even OWASP doesn't seem to have specific detailed information. If anyone has any good websites with this kind of information, please provide them.