Fix/utils extract zip #885
Conversation
Summary of ChangesHello @muhammadolammi, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a critical bug in the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request fixes a bug in the ExtractZip function to correctly handle file paths during extraction, preventing files from being created in the current working directory. The changes also include significant improvements to resource management by fixing a file descriptor leak and using a more efficient method for copying file data. Additionally, a syntax and logic error in a loop within registry/model.go is corrected. My review identifies a critical security vulnerability (Zip Slip) in the updated ExtractZip function and provides a suggestion to mitigate it.
…rent /tmp sub folder instead of cwd Signed-off-by: Muhammad Akewukanwo <[email protected]>
…kipped file Signed-off-by: Muhammad Akewukanwo <[email protected]>
Signed-off-by: Muhammad Akewukanwo <[email protected]>
Signed-off-by: Muhammad Akewukanwo <[email protected]>
Signed-off-by: Muhammad Akewukanwo <[email protected]>
Signed-off-by: Muhammad Akewukanwo <[email protected]>
muhammadolammi
force-pushed
the
fix/utils-ExtractZip
branch
from
9dde1d5 to
d3cd80e
Compare
Signed-off-by: Muhammad Akewukanwo <[email protected]>
muhammadolammi
force-pushed
the
fix/utils-ExtractZip
branch
from
27f6546 to
fb4ff3d
Compare
|
@parthivsaikia, perhaps, you might offer review or @lekaf974 might have a comment or two. |
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| tmpDir, _ := os.MkdirTemp("", "extract-test-*") |
There was a problem hiding this comment.
I think it will be better if we don't ignore these errors.
| if (err != nil) != tt.wantErr { | ||
| t.Errorf("ExtractZip() error = %v, wantErr %v", err, tt.wantErr) | ||
| } |
There was a problem hiding this comment.
The specific error message "zipslip: illegal file path" defined in the struct is not checked here. Please consider checking it too.
3 participants
Description
This fixes the bug in the ExtractZip function; it currently creates all subfolders of the zip inside cwd when using "filename". By using filepath, we make sure it's produced in /tm,p, which other functions calling ExtractZip (like the ProcessContent) expect and depend on
Notes for Reviewers
This PR depends on "fix syntax error in registry/model.go #884" Please merge #884 first.
Signed commits