Open pixeebot[bot] opened 1 month ago
Unable to locate .performanceTestingBot config file
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information
Check out the playback for this Pull Request here.
Thanks @pixeebot[bot] for opening this PR!
For COLLABORATOR only :
To add labels, comment on the issue
/label add label1,label2,label3
To remove labels, comment on the issue
/label remove label1,label2,label3
Processing PR updates...
PR Details of @pixeebot[bot] in elastic-elasticsearch : | OPEN | CLOSED | TOTAL |
---|---|---|---|
1 | 1 | 2 |
[!IMPORTANT]
Review skipped
Bot user detected.
To trigger a single review, invoke the
@coderabbitai review
command.You can disable this status message by setting the
reviews.review_status
tofalse
in the CodeRabbit configuration file.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?
If this change was not helpful, or you have suggestions for improvements, please let me know!
This change shouldn't have any effect on normal unzipping operations -- it should only throw a SecurityException
if it operates on a maliciously created zip.
If there are other concerns about this change, I'd love to hear about them!
This change updates all new instances of ZipInputStream to protect against malicious entries that attempt to escape their "file root" and overwrite other files on the running filesystem.
Normally, when you're using
ZipInputStream
it's because you're processing zip files. That code might look like this:This looks fine when it encounters a normal zip entry within a zip file, looking something like this pseudo-data:
However, there's nothing to prevent an attacker from sending an evil entry in the zip that looks more like this:
Yes, in the above code, which looks like every piece of zip-processing code you can find on the Internet, attackers could overwrite any files to which the application has access. This rule replaces the standard
ZipInputStream
with a hardened subclass which prevents access to entry paths that attempt to traverse directories above the current directory (which no normal zip file should ever do.) Our changes end up looking something like this::x: The following packages couldn't be installed automatically, probably because the dependency manager is unsupported. Please install them manually:
Gradle
dependencies { implementation("io.github.pixee:java-security-toolkit:1.1.3") }Maven
More reading
* [https://snyk.io/research/zip-slip-vulnerability](https://snyk.io/research/zip-slip-vulnerability) * [https://github.com/snyk/zip-slip-vulnerability](https://github.com/snyk/zip-slip-vulnerability) * [https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream](https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream) * [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite)I have additional improvements ready for this repo! If you want to see them, leave the comment:
... and I will open a new PR right away!
🧚🤖 Powered by Pixeebot
💬Feedback | 👥Community | 📚Docs | Codemod ID: pixee:java/harden-zip-entry-paths