Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Code scanning alert #1: Arbitrary file access during archive extraction ("Zip Slip") #77

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −2
Open

fix: Code scanning alert #1: Arbitrary file access during archive extraction ("Zip Slip") #77

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions common/teacmd/editor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@
return os.Remove(tmpZipFileName)
}

func unzipFile(filename string, targetDir string) error {

Check failure on line 194 in common/teacmd/editor.go

View workflow job for this annotation

GitHub Actions / Go 

cognitive complexity 21 of func `unzipFile` is high (> 20) (gocognit)
reader, err := zip.OpenReader(filename)
if err != nil {
return err
Expand All @@ -202,7 +202,10 @@
var originalDir string
for i, file := range reader.File {
if i == 0 {
originalDir = file.Name
originalDir, err = sanitizeExtractPath(filepath.Dir(targetDir), file.Name)
if err != nil {
return err

Check warning on line 207 in common/teacmd/editor.go

View check run for this annotation

Codecov / codecov/patch

common/teacmd/editor.go#L207 

Added line #L207 was not covered by tests
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding test coverage for the error handling path.

The static analysis tool codecov/patch reported that line 207, which is part of the error handling block in the unzipFile function, is not covered by tests. To ensure the robustness of the code and catch potential issues, it's recommended to add test cases that trigger the error path and verify the expected behavior.

Do you want me to generate a test case for this scenario or open a GitHub issue to track this task?

Tools
GitHub Check: codecov/patch

[warning] 207-207: common/teacmd/editor.go#L207
Added line #L207 was not covered by tests

}
}

src, err := file.Open()
Expand Down Expand Up @@ -235,7 +238,7 @@
dst.Close()
}

if err = os.Rename(filepath.Join(filepath.Dir(targetDir), originalDir), targetDir); err != nil {
if err = os.Rename(originalDir, targetDir); err != nil {
return err
}

Expand Down
Loading