CODEWITHSUNDEEP
asp.net-coreasp.net-web-apinuget
Fabio Alves
Fabio Alves

Reputation: 91

Error occurred while restoring Nuget packages

When i try to build my solution (AspnetCore 2.0 using Visual Studio 2019), i get the following error:

Error occurred while restoring NuGet packages: The package 'MySql.Data.7.0.7-m61' contains an entry which is unsafe for extraction.

The same project works in other machine.I've already tried to clean solution, restore packages, but nothing works.What can i do to resolve this?

Upvotes: 0

Views: 485

Answers (2)

pavlos pseftoyiannis
pavlos pseftoyiannis

Reputation: 24

I solved that error by using PackageReference as following :

Add the above line on your project 'myProjectName.csproj' on list.

If that line not solve the problem , change the value of Version on line to Version="7.0.7"

Upvotes: 0

zivkan
zivkan

Reputation: 15071

Have you heard of "zip slip"? It's a zip archive vulnrability where the zip file contains a file whose path is ..\thing, so when you extract it to c:\somewhere it writes to c:\thing, which is obviously outside of the expected c:\somewhere destination. MySql.Data.7.0.7-m61 contains this exploit, although it's not malicious. But still, it's not a good thing, which is why newer NuGet clients forbid extracting it.

Since this package is not malicious, the package author has released newer versions that do not have this problem, so you can upgrade to a newer version of the package. The only possible reason this project works for you on other machines is if you're running old versions of Visual Studio and/or the .NET Core SDK, as NuGet added mitigations for this issue quite some time ago, suggesting you haven't updated on that other machine in all that time.

Upvotes: 1

Related Questions