[Backport 2.x] Replaces ZipInputStream with ZipFile to fix Zip Slip vulnerability (#7230) #7366
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…pensearch-project#7230) * Replaces ZipInputStream with ZipFile to fix ZipSlip vulnerability More details about the vulenrability can be found on https://github.com/snyk/zip-slip-vulnerability Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Adds a CHANGELOG entry Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Changes the base package for ZipFile to avoid forbiddenApisError Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Updates SHAs Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Adds LICENSE and NOTICE files for commons-compress package Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Updates thirdParty ignoreMissingClasses list Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Closes input stream Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes NoSuchFileException when reading files Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes spotless errors Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fixes CHANGELOG.md Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Addresses PR comments Signed-off-by: Darshit Chanpura <dchanp@amazon.com> --------- Signed-off-by: Darshit Chanpura <dchanp@amazon.com> (cherry picked from commit 8422768)
Gradle Check (Jenkins) Run Completed with:
|
Codecov Report
📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more @@ Coverage Diff @@
## 2.x #7366 +/- ##
============================================
+ Coverage 70.23% 70.41% +0.17%
- Complexity 59691 59768 +77
============================================
Files 4850 4850
Lines 287212 287212
Branches 41728 41727 -1
============================================
+ Hits 201737 202235 +498
+ Misses 68564 68075 -489
+ Partials 16911 16902 -9
|
DarshitChanpura
requested review from
reta,
anasalkouz,
andrross,
Bukhtawar,
CEHENKLE,
dblock,
gbbafna,
setiah,
kartg,
kotwanikunal,
mch2,
nknize,
owaiskazi19,
Rishikesh1159,
ryanbogan,
saratvemulapalli,
shwetathareja,
dreamer-89,
tlfeng and
VachaShah
as code owners
dblock
approved these changes
May 3, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Backports #7230 to 2.x
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.