pagure

#5482 fix: generate_archive() follows symbolic links in temporary clones
Merged by wombelix. Opened by wombelix.
wombelix/pagure fix_security_issue_rhbz2280030_generate_archive_follows_symlink  into  master

Download 5482.patch

If the repo contains symlinks, add actual link rather than the target content to the zip archive.
Avoids following symlinks and inclusion of data from outside the repository.

Vulnerability discovered by Thomas Chauchefoin thomas@chauchefoin.fr

Fixes: rhbz#2280030

Signed-off-by: Dominik Wombacher dominik@wombacher.cc

Metadata Update from @wombelix:
- Request assigned

Patch reviewed and validated in Bugzilla. Tests performed locally, all passed.

rebased onto c6ced5d61d1987da23d8e6b5aa8a03379f1f3691

Pull-Request has been merged by wombelix
Metadata
wombelix
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.