PathParcel CLI flags dangerous ZIP path issues before extraction begins

·1 views

A ZIP archive can pass structural validation yet still contain paths that cause collisions, directory traversal, or invalid filenames depending on the target platform. PathParcel is a new open-source Node.js CLI and browser tool that reads ZIP metadata without extracting contents, flagging issues such as case-insensitive collisions, Windows reserved names, parent-traversal segments, and invalid characters. The tool assigns stable error codes to each finding and displays exact stored paths alongside modeled output keys, without silently rewriting or sanitizing anything. It handles edge cases like malformed UTF-8, ZIP64, and split archives by failing explicitly rather than producing a misleading partial report. PathParcel is positioned as a metadata preflight tool, not a security sandbox, and does not inspect compressed file contents, malware, or decompression behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why C# Records Outperform Mutable Classes for DTOs in Modern .NET Apps

A technical analysis argues that mutable C# classes with settable properties are the wrong choice for Data Transfer Objects (DTOs), a practice that has persisted since .NET Framework 2.0. Since C# 9 introduced records, developers have had a structurally immutable alternative better suited to representing data snapshots passed across system boundaries. The article draws on fintech and banking use cases — including payment processing and reconciliation workflows — to illustrate how mutable DTOs can cause real production failures such as duplicate payments and corrupted audit trails. Records enforce immutability by design, preventing unintended mutations as objects travel through validation, fraud screening, and other async pipeline stages. The piece targets engineers at all levels, making the case that records should be the default choice for any DTO in clean, principle-driven .NET development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Widget Storm launches on DevHunt with native DOM web widgets via single script tag

Widget Storm, a library of embeddable web widgets including countdowns, flip cards, and guestbooks, has gone live on DevHunt with its launch week running through Monday. Unlike traditional embeddable widgets that load inside iframes, Widget Storm injects markup directly into the host page's DOM, allowing host CSS to style widgets without fixed-size constraints. The platform addresses security concerns through two methods: static widgets are verified as inert before embedding, while user-created dynamic widgets run inside a WASM sandbox with no filesystem or network access. Originally built in 2008, the modernized platform now supports English and German, offers Composer distribution for PHP developers, and includes a browser-based widget editor called Station. The tool is free to use and the developer is actively responding to feedback on the DevHunt listing throughout the week.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Flutter Dev Debugs Three Stacked Bugs That Silently Erased Noise Map Contours

A developer building Ihanyi Elechi, a Flutter app that visualizes urban noise pollution as a live heatmap over Mapbox, encountered a silent rendering failure where contour layers simply disappeared on certain Android devices without any crash or error log. The first bug traced back to Firestore documents storing coordinates as integers rather than doubles, causing some readings to default to 0.0 and corrupt the bounding-box calculation used to position the raster image. A second issue stemmed from a legacy Firestore query that required a composite index due to a combined where and orderBy clause, which silently returned empty or partial snapshots in release builds depending on cached index state. The third bug involved off-main-isolate PNG rendering that could complete after the map layer update window had already passed, meaning valid image data arrived too late to be painted. All three bugs were individually non-fatal, but their simultaneous occurrence produced a consistent, device-dependent failure with no visible error — making diagnosis especially difficult.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shopify's Missing India Feature Costs Merchants Up to 4% Per Transaction

Indian merchants using Shopify cannot access Shopify Payments, the platform's in-house processor, forcing them to rely on third-party gateways like Razorpay or PayU. This triggers an additional Shopify transaction fee of up to 2% on top of the gateway's own charges, potentially doubling the payment processing cost compared to merchants in supported countries. A detailed cost comparison shows Shopify is cheaper than WooCommerce for Indian stores earning below roughly ₹13.4 lakh annually, after which WooCommerce's flat hosting and maintenance costs become more economical. Upgrading to Shopify's Grow plan to reduce the transaction fee only makes financial sense once annual sales exceed ₹58 lakh. Merchants are advised to verify current plan and gateway rates before making platform decisions, as figures can change.

0 comments Read more at DEV Community