IvanHunters 8738063287 fix(operator): reject tar entries containing ".." before any path operation ...

safeJoin already rejected traversal and re-checked the joined path against
destDir, but the guard sits behind a call boundary that CodeQL's go/zipslip
barrier does not follow, so the extraction loop reported three high-severity
arbitrary-write alerts. Reject the entry name up front instead, which is both
the fail-closed spelling and the shape the analysis recognises. Extend the
traversal test to cover a ".." buried mid-path, not just a leading one.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-09-07 10:58:40 +03:00

..

package_reconciler_test.go

refactor(marketplace): drop artifact-prefix injection and reserved names

2026-09-07 10:58:38 +03:00

package_reconciler.go

refactor(marketplace): drop artifact-prefix injection and reserved names

2026-09-07 10:58:38 +03:00

packagesource_reconciler_test.go

fix(operator): hold final backoff window before give-up, note upstream version skew

2026-07-05 08:30:19 +03:00

packagesource_reconciler.go

refactor(marketplace): fail-safe re-tap rollback and single-source artifact naming

2026-09-07 10:58:37 +03:00

tapmaterializer_artifact_test.go

fix(operator): reject tar entries containing ".." before any path operation

2026-09-07 10:58:40 +03:00

tapmaterializer_artifact.go

fix(operator): reject tar entries containing ".." before any path operation

2026-09-07 10:58:40 +03:00

tapmaterializer_reconciler_test.go

refactor(marketplace): identify taps by marker label, drop community rename

2026-09-07 10:58:38 +03:00

tapmaterializer_reconciler.go

refactor(marketplace): identify taps by marker label, drop community rename

2026-09-07 10:58:38 +03:00