Skip to content

Password protected archives are exposed once they become empty #191

@Earnestly

Description

@Earnestly
  1. Creating a password protected archive with -mhe=on and -p:
$ touch test

$ 7z a -mhe=on -p protected.7z test

# 7-Zip 26.00 (x64) : Copyright (c) 1999-2026 Igor Pavlov : 2026-02-12
#  64-bit locale=en_GB.UTF-8 Threads:4 OPEN_MAX:1024, ASM
#
# Scanning the drive:
# 1 file, 0 bytes
#
# Creating archive: protected.7z
#
# Add new data to archive: 1 file, 0 bytes
#
#
# Enter password:password
#
#
# Files read from disk: 0
# Archive size: 142 bytes (1 KiB)
# Everything is Ok
  1. Demonstrating that listing the contents will prompt for a password, and when entered incorrectly, will return an error.
$ 7z l protected.7z

# 7-Zip 26.00 (x64) : Copyright (c) 1999-2026 Igor Pavlov : 2026-02-12
#  64-bit locale=en_GB.UTF-8 Threads:4 OPEN_MAX:1024, ASM
#
# Scanning the drive for archives:
# 1 file, 142 bytes (1 KiB)
#
# Listing archive: protected.7z
#
#
# Enter password:wrongpassword
#
#
# ERROR: protected.7z : Cannot open encrypted archive. Wrong password?
#
# ERRORS:
# Headers Error
#
#
# Errors: 1
  1. Deleting the last file in the archive.
$ 7z d protected.7z test

# 7-Zip 26.00 (x64) : Copyright (c) 1999-2026 Igor Pavlov : 2026-02-12
#  64-bit locale=en_GB.UTF-8 Threads:4 OPEN_MAX:1024, ASM
#
# Open archive: protected.7z
#
# Enter password:password
#
# --
# Path = protected.7z
# Type = 7z
# Physical Size = 142
# Headers Size = 142
# Solid = -
# Blocks = 0
#
# Updating archive: protected.7z
#
#
# Delete data from archive: 1 file, 0 bytes
# Add new data to archive: 0 files, 0 bytes
#
#
# Files read from disk: 0
# Archive size: 32 bytes (1 KiB)
# Everything is Ok
  1. Adding a new file to the archive which no longer prompts for a password.
$ touch example

$ 7z a protected.7z example

# 7-Zip 26.00 (x64) : Copyright (c) 1999-2026 Igor Pavlov : 2026-02-12
#  64-bit locale=en_GB.UTF-8 Threads:4 OPEN_MAX:1024, ASM
#
# Open archive: protected.7z
# --
# Path = protected.7z
# Type = 7z
# Physical Size = 32
# Headers Size = 32
# Solid = -
# Blocks = 0
#
# Scanning the drive:
# 1 file, 0 bytes
#
# Updating archive: protected.7z
#
# Add new data to archive: 1 file, 0 bytes
#
#
# Files read from disk: 0
# Archive size: 90 bytes (1 KiB)
# Everything is Ok
  1. Demonstrating that the archive is now open and does not require a password to interact with it anymore.
$ 7z l protected.7z

# 7-Zip 26.00 (x64) : Copyright (c) 1999-2026 Igor Pavlov : 2026-02-12
#  64-bit locale=en_GB.UTF-8 Threads:4 OPEN_MAX:1024, ASM
#
# Scanning the drive for archives:
# 1 file, 90 bytes (1 KiB)
#
# Listing archive: protected.7z
#
# --
# Path = protected.7z
# Type = 7z
# Physical Size = 90
# Headers Size = 90
# Solid = -
# Blocks = 0
#
#    Date      Time    Attr         Size   Compressed  Name
# ------------------- ----- ------------ ------------  ------------------------
# 2026-02-16 22:15:42 ....A            0            0  example
# ------------------- ----- ------------ ------------  ------------------------
# 2026-02-16 22:15:42                  0            0  1 files

I think that there should be some kind of warning at least if the last file is removed from a password protected archive or to somehow correct the situation so that the archive, even empty, remains password protected.

Currently I attempt to detect this situation and preemptively remove the archive but it is not an atomic operation.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions