Skip to content

Conversation

jampukka
Copy link
Member

@jampukka jampukka commented Oct 2, 2025

myfeatures - the next generation combination of myplaces (create, update and delete features) and userlayer (import data from GIS files, feature schema is specific to the layer).

Work still in progress.

if (ze.isDirectory()) {
continue;
}
String name = ze.getName();

Check failure

Code scanning / CodeQL

Arbitrary file access during archive extraction ("Zip Slip") High

Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name must appear in validFiles, which contains already sanitized names of files we're interested in. No slipping here.

@ZakarFin ZakarFin added this to the 3.2.0 milestone Oct 2, 2025
@ZakarFin ZakarFin merged commit 6e03274 into oskariorg:develop Oct 2, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants