search

Open-CMSIS-Pack / cpackget

Open-CMSIS-Pack Package Installer
Apache License 2.0
24 stars 15 forks source link

Fix code scanning alert no. 49: Arbitrary file access during archive extraction ("Zip Slip") #368

Closed jkrech closed 1 week ago

jkrech commented 3 weeks ago

Fixes https://github.com/Open-CMSIS-Pack/cpackget/security/code-scanning/49

To fix the problem, we need to ensure that the file paths extracted from the zip archive do not contain any directory traversal sequences like ... This can be done by adding a check to ensure that the file paths are safe before using them in file operations.

  1. Add a check to ensure that the file paths do not contain .. before using them.
  2. Modify the validate method in cmd/installer/pack.go to include this check.
  3. Ensure that the utils.SecureInflateFile function is only called with sanitized paths.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

jkrech commented 3 weeks ago

@bgn42 could you add a test for a pack file that uses .. as file reference to get the coverage up if you think this is useful.

codeclimate[bot] commented 1 week ago

Code Climate has analyzed commit 42765eda and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.8% (0.0% change).

View more on Code Climate.