You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@commons.apache.org by GitBox <gi...@apache.org> on 2026/10/21 03:16:53 UTC

[GH] (commons-compress/COMPRESS-727-secure-extractor): Workflow run "Dependency Review" failed!

The GitHub Actions job "Dependency Review" on commons-compress.git/COMPRESS-727-secure-extractor has failed.
Run started by GitHub user tomasilluminati (triggered by tomasilluminati).

Head commit for run:
4d04bcb23416db394fd41b50913eaf117ad5694b / tomasilluminati <to...@owasp.org>
[COMPRESS-727] Pin the lexical zip-slip guard, add UNC tests

resolveWithinRoot decides containment from the name alone. Any file system call before Path#startsWith would touch an attacker-chosen location, and on Windows a UNC name would reach the network before the entry is rejected. The Javadoc now states that invariant.

Tests pin it: a host/share name on every platform through ZipFile, ZipArchiveInputStream and tar, Windows-only UNC, drive and drive-relative spellings, and Windows illegal names that fail closed through the InvalidPathException wrapper. They accept only the guard's own ArchiveException, so a FileSystemException fails them. No logic change.

Report URL: https://github.com/apache/commons-compress/actions/runs/35556889881

With regards,
GitHub Actions via GitBox