Skip to content

Commit

Permalink
fix: use for
Browse files Browse the repository at this point in the history
  • Loading branch information
bokuweb committed Jun 11, 2024
1 parent 71f1e12 commit 70bd15b
Showing 1 changed file with 9 additions and 20 deletions.
29 changes: 9 additions & 20 deletions src/service.ts
Original file line number Diff line number Diff line change
Expand Up @@ -27,26 +27,15 @@ const downloadExpectedImages = async (client: DownloadClient, latestArtifactId:
const zip = await client.downloadArtifact(latestArtifactId);
const buf = Buffer.from(zip.data as any);
log.info(`Downloaded zip size = ${buf.byteLength}`);
await Promise.all(
new Zip(buf)
.getEntries()
.filter(f => {
log.info('entryName:', f.entryName);
return !f.isDirectory && f.entryName.startsWith(constants.ACTUAL_DIR_NAME);
})
.map(async file => {
const f = path.join(
workspace(),
file.entryName.replace(constants.ACTUAL_DIR_NAME, constants.EXPECTED_DIR_NAME),
);
await makeDir(path.dirname(f));
log.info('download to', f);
await fs.promises.writeFile(f, file.getData());
}),
).catch(e => {
log.error('Failed to extract images.', e);
throw e;
});
const entries = new Zip(buf).getEntries();
log.info(`entry size = ${entries.length}`);
for (const entry of entries) {
if (entry.isDirectory || !entry.entryName.startsWith(constants.ACTUAL_DIR_NAME)) continue;
const f = path.join(workspace(), entry.entryName.replace(constants.ACTUAL_DIR_NAME, constants.EXPECTED_DIR_NAME));

Check failure

Code scanning / CodeQL

Arbitrary file access during archive extraction ("Zip Slip") High

Unsanitized archive entry, which may contain '..', is used in a
file system operation
.
await makeDir(path.dirname(f));
log.info('download to', f);
await fs.promises.writeFile(f, entry.getData());
}
} catch (e: any) {
if (e.message === 'Artifact has expired') {
log.error('Failed to download expected images. Because expected artifact has already expired.');
Expand Down

0 comments on commit 70bd15b

Please sign in to comment.