Migrate syft to use archives instead of anchore fork #4029
Conversation
Signed-off-by: Kudryavcev Nikolay <[email protected]>
Signed-off-by: Kudryavcev Nikolay <[email protected]>
Signed-off-by: Kudryavcev Nikolay <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
| cleanupFn := func() error { | ||
| return os.RemoveAll(tempDir) | ||
| visitor := func(_ context.Context, file archives.FileInfo) error { | ||
| destPath, err := intFile.SafeJoin(tempDir, file.NameInArchive) |
There was a problem hiding this comment.
I updated this to use the same kind of SafeJoin functionality so we don't escape the tmpDir like we do in other parts of syft. If the archives library already handles this internally apologies I just couldn't find it on a quick inspection.
|
@wagoodman I've looked at this one and added a small protection. The visitor now uses a path aware directory join and cannot write outside the temp directory. Also, I don't know what Static Analysis is on about here. I've checked out this branch even on a different machine and it's told me the go.mod and go.sum are tidy locally |
Signed-off-by: Christopher Phillips <[email protected]>
Signed-off-by: Christopher Phillips <[email protected]>
There was a problem hiding this comment.
This one now looks good to me after a first pass review. I identified a section in the visitor where we might be able to escape and write files to paths outside the temp directory so added a fix for this. I'd like additional 👀 from someone on @anchore/tools to check my work.
spiffcs
dismissed
their stale review
one more change is needed here where we also protect against symlink attacks
2 participants
Description
Rewritten deprecated fork github.com/anchore/archiver to github.com/mholt/archives
Type of change
Checklist: