mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-10-22 06:13:00 +00:00
hsdfatandGitHub
30114a6851
Scorecard supply-chain security / Scorecard analysis (push) Skipped
Run the E2E test on kind / setup-test-matrix (push) Failing after 19m6s
push.yml / extract (push) Failing after 12s
Main CI / get-go-version (push) Failing after 26m20s
Main CI / Build (push) Skipped
e2e-test-kind.yaml / extract (push) Failing after 10m13s
Run the E2E test on kind / get-go-version (push) Failing after 38m37s
Run the E2E test on kind / build (push) Skipped
Run the E2E test on kind / run-e2e-test (push) Skipped
* Fix Zip Slip path check accepting a sibling directory in archive extraction sanitizeArchivePath confirmed an extracted tar entry stayed inside the destination directory with strings.HasPrefix. HasPrefix has no separator boundary, so a sibling directory whose name begins with the destination directory's name - reached via a "../<destDir-name>-evil/x" entry - satisfied the check and escaped the directory. Verify containment with filepath.Rel instead, matching the check #10102 added to GetVersionedItemFilePath, rejecting a relative path equal to ".." or under "../". Fixes #10184 Signed-off-by: phatlc <phatle.hsd@gmail.com> * Pin sanitizeArchivePath behaviour for entries naming destDir itself An entry named "." or one with an empty name joins to destDir, so filepath.Rel returns "." and the path is accepted. That is correct - it is contained - but the table did not state it, and the returned path was not asserted at all. Add the two rows and check targetPath on the accepted cases so the containment boundary is pinned on both sides. Signed-off-by: phatlc <phatle.hsd@gmail.com> --------- Signed-off-by: phatlc <phatle.hsd@gmail.com>