search

google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.56k stars 121 forks source link

jar: iterate over zip file headers instead of using fs.WalkDir #20

Closed ericchiang closed 2 years ago

ericchiang commented 2 years ago

Avoid some of the edge cases we've hit when combining archive/zip and fs.WalkDir and iterate over the ZIP files directly. Lets us drop some workarounds.

Negative is that we have to break a public API, but hopefully that's okay while we're pre v1.0.0.

PR attempts to make the diff as small as possible.

https://github.com/google/log4jscanner/issues/12 https://github.com/golang/go/issues/50390 https://github.com/golang/go/issues/50179