{"action":"created","issue":{"url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3425","repository_url":"https://api.github.com/repos/jenkinsci/jenkins","labels_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3425/labels{/name}","comments_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3425/comments","events_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3425/events","html_url":"https://github.com/jenkinsci/jenkins/pull/3425","id":320594245,"number":3425,"title":"handle relative paths correctly when unzipping","user":{"login":"aviadatsnyk","id":24290431,"avatar_url":"https://avatars2.githubusercontent.com/u/24290431?v=4","gravatar_id":"","url":"https://api.github.com/users/aviadatsnyk","html_url":"https://github.com/aviadatsnyk","followers_url":"https://api.github.com/users/aviadatsnyk/followers","following_url":"https://api.github.com/users/aviadatsnyk/following{/other_user}","gists_url":"https://api.github.com/users/aviadatsnyk/gists{/gist_id}","starred_url":"https://api.github.com/users/aviadatsnyk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aviadatsnyk/subscriptions","organizations_url":"https://api.github.com/users/aviadatsnyk/orgs","repos_url":"https://api.github.com/users/aviadatsnyk/repos","events_url":"https://api.github.com/users/aviadatsnyk/events{/privacy}","received_events_url":"https://api.github.com/users/aviadatsnyk/received_events","type":"User","site_admin":false},"labels":[{"id":376626348,"url":"https://api.github.com/repos/jenkinsci/jenkins/labels/needs-jira-issue","name":"needs-jira-issue","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-05-06T13:48:21Z","updated_at":"2018-05-07T16:56:05Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/jenkinsci/jenkins/pulls/3425","html_url":"https://github.com/jenkinsci/jenkins/pull/3425","diff_url":"https://github.com/jenkinsci/jenkins/pull/3425.diff","patch_url":"https://github.com/jenkinsci/jenkins/pull/3425.patch"},"body":"When checking that an unzipped file does not break out of the target directory - this handle relative paths correctly, where the previous implementation might not. This should prevent a bug that might have been introduced in #3402. For example: if the target directory is `./the-dir` and the unzipping happens in `/a/b/c` an archive with a file path `/a/b/c/the-dir` which should be legal, will throw an exception.\r\n\r\nI don't know if this is even possible under jenkins, but it's a bug nonetheless.\r\n\r\n\r\n<!-- Comment: \r\nIf the issue is not fully described in the ticket, add more information here (justification, pull request links, etc.).\r\n\r\n * We do not require JIRA issues for minor improvements.\r\n * Bugfixes should have a JIRA issue (backporting process).\r\n * Major new features should have a JIRA issue reference.\r\n-->\r\n\r\n### Proposed changelog entries\r\n* internal: fix a bug introduced in #3402 \r\n\r\n<!-- Comment: \r\nThe changelogs will be integrated by the core maintainers after the merge.  See the changelog examples here: https://jenkins.io/changelog/ -->\r\n\r\n### Submitter checklist\r\n\r\n- [x] JIRA issue is well described\r\n- [ ] Changelog entry appropriate for the audience affected by the change (users or developer, depending on the change). [Examples](https://github.com/jenkins-infra/jenkins.io/blob/master/content/_data/changelogs/weekly.yml)\r\n      * Use the `Internal: ` prefix if the change has no user-visible impact (API, test frameworks, etc.)\r\n- [ ] Appropriate autotests or explanation to why this change has no tests\r\n\r\n<!-- For new API and extension points: Link to the reference implementation in open-source (or example in Javadoc) -->\r\n\r\n### Desired reviewers\r\n\r\n\r\n\r\n<!-- Comment:\r\nIf you need an accelerated review process by the community (e.g., for critical bugs), mention @jenkinsci/code-reviewers\r\n-->\r\n"},"comment":{"url":"https://api.github.com/repos/jenkinsci/jenkins/issues/comments/387130467","html_url":"https://github.com/jenkinsci/jenkins/pull/3425#issuecomment-387130467","issue_url":"https://api.github.com/repos/jenkinsci/jenkins/issues/3425","id":387130467,"user":{"login":"daniel-beck","id":1831569,"avatar_url":"https://avatars3.githubusercontent.com/u/1831569?v=4","gravatar_id":"","url":"https://api.github.com/users/daniel-beck","html_url":"https://github.com/daniel-beck","followers_url":"https://api.github.com/users/daniel-beck/followers","following_url":"https://api.github.com/users/daniel-beck/following{/other_user}","gists_url":"https://api.github.com/users/daniel-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-beck/subscriptions","organizations_url":"https://api.github.com/users/daniel-beck/orgs","repos_url":"https://api.github.com/users/daniel-beck/repos","events_url":"https://api.github.com/users/daniel-beck/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-beck/received_events","type":"User","site_admin":false},"created_at":"2018-05-07T16:56:05Z","updated_at":"2018-05-07T16:56:05Z","author_association":"OWNER","body":"@aviadatsnyk Don't you mean absolute paths?"}}
{"actor":{"display_login":"daniel-beck"}}