[Security] Unable to extract files from nupkg when different file name encoding is used #2816

Impact

When extracting the contents of a Chocolatey package (a .nupkg file), depending on the encoding of the file name, Chocolatey is not able to understand about the existence of the file. This causes a problem in terms of how Chocolatey interrogates the contents of a file in order to send a file for scanning (via VirusTotal), as well as performing other functions on the file.

This means that there is the potential for a malicious file to be included within the nupkg file, and for Chocolatey not to be aware of the problem.

This issue stems from a change in the way that the underlying NuGet libraries handle the encoding of file names when they are added to the nupkg file. We need to make NuGet.Core aware of the all the known ways to encode the file name, so that it can correctly handle the extraction of all files contained within the nupkg file.

Patches

A fix for this problem has been released in version 2.11.0.20220901 of the customised version of NuGet.Core which is maintained by the Chocolatey Team.

Workarounds

There are no known workaround to this problem.

References

N/A