Potential fix for code scanning alert no. 2389: Arbitrary file access during archive extraction ("Zip Slip") - #6250

Draft

eriknordmark wants to merge 1 commit into

alert-autofix-2389

GitHub Advanced Security / CodeQL failed Jul 31, 2026 in 5s

3 new alerts including 3 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

3 high

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 27 in evetest/utils/tar.go

Code scanning / CodeQL

Arbitrary file access during archive extraction ("Zip Slip") High

Unsanitized archive entry, which may contain '..', is used in a

.
Unsanitized archive entry, which may contain '..', is used in a

.
Unsanitized archive entry, which may contain '..', is used in a

.
Unsanitized archive entry, which may contain '..', is used in a

.
Unsanitized archive entry, which may contain '..', is used in a

.
Unsanitized archive entry, which may contain '..', is used in a

.

Check failure on line 47 in evetest/utils/tar.go

Code scanning / CodeQL

Arbitrary file write extracting an archive containing symbolic links High

Unresolved path from an archive header, which may point outside the archive root, is used in

.

Check failure on line 86 in evetest/utils/tar.go

Code scanning / CodeQL

Arbitrary file write extracting an archive containing symbolic links High

Unresolved path from an archive header, which may point outside the archive root, is used in

.