reporting missing entries in the central directory

[armijnhemel]

Although according to the ZIP specification that each file in the ZIP archive with a local header should have a matching entry in the central directory it does not seem to be enforced. The central directory is merely used as a lookup table, without checking the integrity of the entire archive.

There are ZIP archives out there in the wild where there are entries with a local header, but without a corresponding entry in the central directory. There are even file formats that are using this as a method to store metadata, such as SOZip:

https://github.com/sozip/sozip-spec
https://github.com/sozip/sozipfile

(links include test files)

The question is whether or not these files should be unpacked or not. In the case of SOzip the files are clearly metadata, but there could be other archives where the files are not metadata (and are used for, say, smuggling a payload through a malware scanner). A linter should at least be able to spot that there are extra files.

Somewhat related is what Google does with APK signing blocks, but that will be a separate issue (as those don't have a local header).

[armijnhemel]

From my own notes:

Seek-Optimized ZIP

A fairly obscure format is the "Seek-Optimized ZIP" format, or [SOZip][sozip].
This format, originating in the geospatial workd, adds extra files to the ZIP
file that contain metadata that can be used for quick random access for
compressed data. This metadata is added as regular files, but without a
corresponding entry in the central directory. A SOZip-aware reader can use
these files to do quick seeks in the file and a reader that is not aware will
not notice these files and ignore them.

This is explicitly not allowed according to section 4.3.2:

4.3.2 Each file placed into a ZIP file MUST be preceded by  a "local
file header" record for that file.  Each "local file header" MUST be
accompanied by a corresponding "central directory header" record within
the central directory section of the ZIP file.

Every unpacker tested (unzip, p7zip, Python's zipfile) ignores the
extra files.

The extra files are metadata, not actual files. A correct unpacker should
probably write these extra files to a different location than the contents of
the ZIP file.