Please support .zip attachments

[waclawek.jan]

The forum allows .z, .7z, but does not allow .zip attachments.

Please fix.

JW

[RhSilicon]

:see_no_evil_monkey:

[Tesla DeLorean]

+1

Not any more intrinsically safe / unsafe as an other archiving method, and can be scanned. Lack of support just adds to reasons not to participate.

[Lina_DABASINSKAITE]

Hello all, 

The type: .zip is excluded due security recommendations. Let me please check internally what could be done about it. 

BR,
Lina

[Tesla DeLorean]

The security issue would be WHAT'S IN THE ZIP, the integrity of the files can be readily established, and the content scanned for threats.

Don't allow them to contain EXE/DLL files, or be password protected / encrypted.

[Johi]

Very good proposal. On top of this the 5 MB limit is also a bit outdated. At least we should be able to share zipped example programs to support each other and indirectly ST.

[Piranha]

Tried adding some files to this topic:

https://community.st.com/t5/stm32-mcus-embedded-software/how-to-make-ethernet-and-lwip-working-on-stm32/td-p/261456

The RAR, 7Z, TAR and XZ archives are supported, but not ZIP because of "security". Also does any of those "security experts" even know that a DOCX, XLSX and PTPX files are also ZIP files with a different extension? @Lina_DABASINSKAITE , do you have any clue what level of nonsense you are talking here?

Oh, but it lists HEX as an accepted format - let's try that...

A perfectly normal HEX files "does not match its file extension". One can see those HEX files added to that topic as a TXT files.

[waclawek.jan]

This is still a bug. As explained above, "security concern" is nonsense.

JW

[Tesla DeLorean]

.docx are ZIP files..

[waclawek.jan]

@Lina_DABASINSKAITE, @Amelie ACKERMANN , can this please be rectified asap.

We need to be able to exchange packs of files. .zip is an industry standard, and, as pointed out by many, other packed formats (some of which are proprietary thus require installing/running proprietary unpackers, hence pose a significantly larger security risk) are allowed; and also formats which in fact have the same underlying .zip structure.

In other words, the quoted security concerns are moot.

We need to exchange .hex and .elf files, too - either standalone or as part of .zip  - those result from source files compilation and are vital for being able to help users with specific problems which stem from the compilation process. Those don't pose any significant security issues either, as they are not run on PCs but on microcontrollers.

JW

[Amelie ACKERMANN]

Hi @waclawek.jan,

I understand your point. After one year of being on the new platform, we can bring up the topic of .zip files again with the security team. However, I cannot give any promises that their assessment of the topic has changed. I will let you know if there is any news.

Best,

Amelie

[Tesla DeLorean]

I'm struggling to understand the "security" concern here. The files are inert, you can scan the content for things you don't want, or don't know how to decode/unpack. It's the same format used for .DOCX / .XLSX, so if I can hide and stash things in those surely those amount to the same risk?

Is the concern that bad actors might cache content you don't want to be caught hosting here?

[Andrew Neil]

---

@waclawek.jan wrote:

The forum allows .z, .7z, but does not allow .zip attachments.

---

As a workaround, I think you can rename a .zip to  .z or .7z - and the forum won't notice!

:face_with_rolling_eyes:

 

---

@waclawek.jan wrote:

Please fix.

---

Yes - please fix!

After all, ST is happy enough to distribute its stuff to us as .zip !

[Laurids_PETERSEN]

Hello @waclawek.jan and all,

I'm happy to let you know that .zip files are now allowed in the community.

Best regards,
Laurids