Skip to content

Use unzipper fallback with decompress #856

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
bstack-security-github merged 5 commits into from
Aug 27, 2024
Merged

Use unzipper fallback with decompress #856

bstack-security-github merged 5 commits into from
Aug 27, 2024

Conversation

@asambstack
Copy link
Collaborator

@asambstack asambstack commented Aug 22, 2024 •
edited
Loading

  • Handling promise rejections for build artifacts unzipping failures
  • Added unzipper library fallback to decompress library for reducing unzipping failures

github-advanced-security[bot]
github-advanced-security bot found potential problems Aug 22, 2024
View reviewed changes
bin/helpers/buildArtifacts.js
await decompress(path.join(filePath, fileName), filePath)
.then((files) => {
try {
await decompress(path.join(filePath, fileName), filePath);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
bin/helpers/buildArtifacts.js
await decompress(path.join(filePath, fileName), filePath)
.then((files) => {
try {
await decompress(path.join(filePath, fileName), filePath);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
bin/helpers/buildArtifacts.js
} catch (error) {
logger.debug(`Error unzipping with decompress, trying with unzipper. Stacktrace: ${error}.`);
try {
fs.createReadStream(path.join(filePath, fileName))

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
bin/helpers/buildArtifacts.js
} catch (error) {
logger.debug(`Error unzipping with decompress, trying with unzipper. Stacktrace: ${error}.`);
try {
fs.createReadStream(path.join(filePath, fileName))

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
pranavj1001
pranavj1001 reviewed Aug 23, 2024
View reviewed changes
pranavj1001
pranavj1001 reviewed Aug 23, 2024
View reviewed changes
@ShashankG-Gollapally
Copy link
Contributor

ShashankG-Gollapally commented Aug 26, 2024

RUN_SCA

@bstack-security-github bstack-security-github merged commit 2660676 into master Aug 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pranavj1001 pranavj1001 pranavj1001 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@asambstack @ShashankG-Gollapally @pranavj1001 @bstack-security-github