{"action":"created","issue":{"url":"https://api.github.com/repos/pulp/pulp/issues/3670","repository_url":"https://api.github.com/repos/pulp/pulp","labels_url":"https://api.github.com/repos/pulp/pulp/issues/3670/labels{/name}","comments_url":"https://api.github.com/repos/pulp/pulp/issues/3670/comments","events_url":"https://api.github.com/repos/pulp/pulp/issues/3670/events","html_url":"https://github.com/pulp/pulp/pull/3670","id":363939298,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE4MjQ4OTUx","number":3670,"title":"Confine symlink paths under the build_dir","user":{"login":"dparalen","id":813753,"node_id":"MDQ6VXNlcjgxMzc1Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/813753?v=4","gravatar_id":"","url":"https://api.github.com/users/dparalen","html_url":"https://github.com/dparalen","followers_url":"https://api.github.com/users/dparalen/followers","following_url":"https://api.github.com/users/dparalen/following{/other_user}","gists_url":"https://api.github.com/users/dparalen/gists{/gist_id}","starred_url":"https://api.github.com/users/dparalen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dparalen/subscriptions","organizations_url":"https://api.github.com/users/dparalen/orgs","repos_url":"https://api.github.com/users/dparalen/repos","events_url":"https://api.github.com/users/dparalen/events{/privacy}","received_events_url":"https://api.github.com/users/dparalen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2018-09-26T09:37:39Z","updated_at":"2018-11-05T12:37:19Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/pulp/pulp/pulls/3670","html_url":"https://github.com/pulp/pulp/pull/3670","diff_url":"https://github.com/pulp/pulp/pull/3670.diff","patch_url":"https://github.com/pulp/pulp/pull/3670.patch"},"body":"The file distributor doesn't ensure the path of a symlink being created is\r\ncontained under the `build_dir`. As a result, a rogue input such as an ISO\r\nManifest that contains relative paths, could make Pulp write content to an\r\narbitrary system folder upon publish.\r\n\r\nThis patch prevents the issue by always confining symlink paths under the\r\n`build_dir`.\r\n\r\nFixes: #3841\r\nhttps://pulp.plan.io/issues/3841\r\n\r\n### Pull Requests\r\n\r\nPlease be sure you have read our documentation regarding contributing\r\nhere:\r\nhttps://docs.pulpproject.org/en/3.0/nightly/contributing/index.html\r\n\r\nThere you can read a Contribution Checklist and learn more about\r\nappropriate branches and rebasing among other things.\r\n\r\nOnce you are ready to create a pull request:\r\n\r\n- [ ] For properly formatting commit messages, please see the\r\ndocumentation here:\r\nhttps://docs.pulpproject.org/en/3.0/nightly/contributing/git.html#commit-message\r\n- [ ] Once you have created your pull request, please add a link to\r\nyour pull request into the notes/comments for the relevant bug in the\r\nissue tracker and change the status to POST.\r\n- [ ] Continuous integration tests will be automatically triggered\r\nby your pull request.  You can see the status of these tests on the\r\npage for your pull request.  If there are failures, please try to\r\nfix them and update your pull request.\r\n\r\nThank you so much for contributing to Pulp!\r\n"},"comment":{"url":"https://api.github.com/repos/pulp/pulp/issues/comments/435859295","html_url":"https://github.com/pulp/pulp/pull/3670#issuecomment-435859295","issue_url":"https://api.github.com/repos/pulp/pulp/issues/3670","id":435859295,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTg1OTI5NQ==","user":{"login":"dparalen","id":813753,"node_id":"MDQ6VXNlcjgxMzc1Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/813753?v=4","gravatar_id":"","url":"https://api.github.com/users/dparalen","html_url":"https://github.com/dparalen","followers_url":"https://api.github.com/users/dparalen/followers","following_url":"https://api.github.com/users/dparalen/following{/other_user}","gists_url":"https://api.github.com/users/dparalen/gists{/gist_id}","starred_url":"https://api.github.com/users/dparalen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dparalen/subscriptions","organizations_url":"https://api.github.com/users/dparalen/orgs","repos_url":"https://api.github.com/users/dparalen/repos","events_url":"https://api.github.com/users/dparalen/events{/privacy}","received_events_url":"https://api.github.com/users/dparalen/received_events","type":"User","site_admin":false},"created_at":"2018-11-05T12:37:19Z","updated_at":"2018-11-05T12:37:19Z","author_association":"CONTRIBUTOR","body":"@dralley @jortel, rebased, please let me know if I can do anything else.\r\nSorry for a later response due to my travelling."}}
{"actor":{"display_login":"dparalen"}}