 Brian Donovan
|
14e7c50478
|
fix(cli): prevent "zip slip" vulnerability in tool extract
Using the name directly from a zip archive's entry and writing to it is a potential security vulnerability. More information about the vulnerability can be found here: https://security.snyk.io/research/zip-slip-vulnerability and here https://docs.rs/zip/latest/zip/read/struct.ZipFile.html#warnings.
It looks like the previous version maybe tried to remove `\` characters to prevent this, but only in directory paths?
|
2023-08-04 20:02:07 -07:00 |
|