zip slip vulnerability - Githubissues

sbt / io

IO module for sbt

Apache License 2.0

40 stars 45 forks source link

zip slip vulnerability #358

Closed xuwei-k closed 10 months ago

xuwei-k commented 10 months ago

How to fix? 🤔

change filter: NameFilter = AllPassFilter default param?
- https://github.com/sbt/io/blob/c0e002311523e1597063f7d75650a3bdb7fe2627/io/src/main/scala/sbt/io/IO.scala#L367-L386
add explicit filter param in user code?
- https://github.com/sbt/sbt/blob/da41144f37c32cbc0a64e3a91b505ce568869166/main/src/main/scala/sbt/Resolvers.scala#L44
- https://github.com/sbt/sbt/blob/da41144f37c32cbc0a64e3a91b505ce568869166/main/src/main/scala/sbt/internal/RemoteCache.scala#L416
another solutions?

eed3si9n commented 10 months ago

I have a fix here - https://github.com/sbt/io/pull/360