hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

add "linkname" as a file-name-property for zip-slip

Browse Source
This commit is contained in:
Erik Krogh Kristensen
2020-05-14 08:49:39 +02:00
parent a19718a10f
commit 71e7083dcb
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
javascript/ql/src/semmle/javascript/security/dataflow/ZipSlipCustomizations.qll
View File

@@ -47,11 +47,13 @@ module ZipSlip {
)
}
/** Gets a property that is used to get the filename part of an archive entry. */
/** Gets a property that is used to get a filename part of an archive entry. */
private string getAFilenameProperty() {
result = "path" // Used by library 'unzip'.
or
result = "name" // Used by library 'tar-stream'.
or
result = "linkname" // linked file name, used by 'tar-stream'.
}
/** An archive entry path access, as a source for unsafe archive extraction. */