Branch: refs/heads/master Home: https://github.com/openSUSE/osc Commit: a3ed68508bbee5965a517559f90a60ab76101e33 https://github.com/openSUSE/osc/commit/a3ed68508bbee5965a517559f90a60ab76101... Author: Daniel Mach Date: 2024-05-28 (Tue, 28 May 2024) Changed paths: M osc/core.py Log Message: ----------- Remove no longer valid warning from core.unpack_srcrpm() Shell injection is not possible with Popen() which has shell=False as a default. Commit: d61b781976e21b8253ca72daf4b406cfa6f8e9ad https://github.com/openSUSE/osc/commit/d61b781976e21b8253ca72daf4b406cfa6f8e... Author: Daniel Mach Date: 2024-05-30 (Thu, 30 May 2024) Changed paths: M osc/util/ar.py A tests/fixtures/README A tests/fixtures/archive.ar A tests/test_util_ar.py Log Message: ----------- Forbid extracting files with absolute path from 'ar' archives (boo#1122683) Also fix and modernize the code, add tests. Commit: 5cbd110a844714d764cc2f04a43603d5ea55c3e4 https://github.com/openSUSE/osc/commit/5cbd110a844714d764cc2f04a43603d5ea55c... Author: Daniel Mach Date: 2024-05-30 (Thu, 30 May 2024) Changed paths: M osc/util/cpio.py M tests/fixtures/README A tests/fixtures/archive.cpio A tests/test_util_cpio.py Log Message: ----------- Forbid extracting files with absolute path from 'cpio' archives (boo#1122683) Also fix and modernize the code, add tests. Commit: d92f2677f4b061d877f9cba96d1067227ccba7ca https://github.com/openSUSE/osc/commit/d92f2677f4b061d877f9cba96d1067227ccba... Author: Daniel Mach Date: 2024-06-03 (Mon, 03 Jun 2024) Changed paths: M osc/core.py M osc/util/ar.py M osc/util/cpio.py A tests/fixtures/README A tests/fixtures/archive.ar A tests/fixtures/archive.cpio A tests/test_util_ar.py A tests/test_util_cpio.py Log Message: ----------- Merge pull request #1571 from dmach/boo1122683-insecure Fix insecure extraction of 'ar' and 'cpio' archives by forbidding extracting files with absolute paths Compare: https://github.com/openSUSE/osc/compare/e98164579150...d92f2677f4b0 To unsubscribe from these emails, change your notification settings at https://github.com/openSUSE/osc/settings/notifications