Repository navigation
Bundle symlink fix - #2083
Merged
reinecke merged 2 commits intoOct 30, 2026
Merged
Bundle symlink fix#2083
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2083 +/- ##
==========================================
- Coverage 83.62% 83.59% -0.04%
==========================================
Files 184 184
Lines 13627 13632 +5
Branches 1270 1271 +1
==========================================
Hits 11395 11395
- Misses 2059 2064 +5
Partials 173 173
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
jhodges10
approved these changes
Oct 30, 2026
jhodges10
left a comment
jhodges10
left a comment
Collaborator
There was a problem hiding this comment.
Looks good to me, thanks for getting this fix in @darbyjohnston!
Extracting an entry saved as a symbolic link created the link, and the zip slip check only looks at the entry's own path, so a crafted bundle could extract a link to a file outside of the extract path. Bundles do not contain links, so extracting one is now an error. Signed-off-by: Darby Johnston <[email protected]>
4.2.2 rejects symbolic link targets that escape the extraction directory. Signed-off-by: Darby Johnston <[email protected]>
reinecke
force-pushed
the
otioz-symlink-fix
branch
from
October 30, 2026 21:30
5028e17 to
91bced5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes an issue where symbolic links could be extracted from bundles, which could point to files outside of the extraction directory. Symbolic links are not valid entries, so this change adds a check for them and gives an error if one is found.
This also updates minizip-ng to 4.2.2, which has a similar fix.
Assisted-by: Claude Code / Claude Opus 5.5