mirror of
https://github.com/l0ng-ai/openidea.git
synced 2026-11-07 00:07:29 +00:00
l0ng-ai
7da58637c2
cargo deny check now passes, with a deny.toml at the repository root (advisories, licenses, bans, sources). - zip 2.4.2 → 9 as one workspace dependency (RUSTSEC-2026-0367/0368/0369). Our own extraction is hardened too: tar/zip entries cannot escape the destination, symlinks are allowed only when they resolve inside it, entries cannot traverse a symlink, and setuid/setgid/sticky bits are dropped (also after system tar). - tiberius 0.12 → 0.13 with rustls 0.23, which brings the fixed rustls / rustls-webpki (RUSTSEC-2026-0098/0099/0104/0346/0349/0382/0383). The bb8-tiberius adapter is replaced by a small bb8 connection manager in ide-db that keeps its single-redirect handling. - crypto-bigint / ctutils updated (RUSTSEC-2026-0385/0387). - rsa RUSTSEC-2023-0071 (no fixed release) is ignored with its reason: RSA is used only for MySQL password encryption and SSH signatures, never to decrypt attacker-controlled ciphertext. - Unmaintained transitive crates (paste, proc-macro-error, rustls-pemfile, zbus/zvariant) remain warnings. MPL-2.0 is allowed (file-level copyleft, dependencies used unmodified). 未在真实 SQL Server 及 Windows / Linux 上验证解压。
28 lines
900 B
Python
28 lines
900 B
Python
"""Regenerate the malicious tar fixtures used by archive.rs tests (Python stdlib only)."""
|
|
|
|
import bz2
|
|
import io
|
|
import lzma
|
|
from pathlib import Path
|
|
import tarfile
|
|
|
|
archive = io.BytesIO()
|
|
with tarfile.open(fileobj=archive, mode="w", format=tarfile.GNU_FORMAT) as tar:
|
|
for name, target, data in [
|
|
("link", "../outside", b""),
|
|
("link/victim", None, b"replaced"),
|
|
("../escaped", None, b"escaped"),
|
|
("special", None, b"special"),
|
|
]:
|
|
entry = tarfile.TarInfo(name)
|
|
entry.mode = 0o7777
|
|
if target:
|
|
entry.type = tarfile.SYMTYPE
|
|
entry.linkname = target
|
|
else:
|
|
entry.size = len(data)
|
|
tar.addfile(entry, io.BytesIO(data))
|
|
|
|
for extension, compress in [("xz", lzma.compress), ("bz2", bz2.compress)]:
|
|
Path(__file__).with_name(f"escape.tar.{extension}").write_bytes(compress(archive.getvalue()))
|