From 6d6c99ff6be38d9b577eef4175083a2bc669a911 Mon Sep 17 00:00:00 2001
From: LCB <lbellows@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:38:41 -0400
Subject: [PATCH] pin gosu, fail closed on BuildTools download, reject zip slip
 (#4247)

---
 Dockerfile                       |  2 +-
 scripts/start-deployBukkitSpigot |  2 +-
 scripts/start-utils              | 12 ++++++++++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 67d3259f..d973d114 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@ ARG KNOCKD_REPO_ORG=Metalcape/knock
 RUN --mount=target=/build,source=build \
     TARGET=${TARGETARCH}${TARGETVARIANT} \
     /build/run.sh install-packages
-COPY --from=tianon/gosu /gosu /usr/local/bin/
+COPY --from=tianon/gosu:1.19 /gosu /usr/local/bin/
 
 RUN --mount=target=/build,source=build \
     /build/run.sh setup-user
diff --git a/scripts/start-deployBukkitSpigot b/scripts/start-deployBukkitSpigot
index 1b8c83eb..e4b0a779 100755
--- a/scripts/start-deployBukkitSpigot
+++ b/scripts/start-deployBukkitSpigot
@@ -43,7 +43,7 @@ function buildSpigotFromSource {
   fi
 
   logn ''
-  curl -sSL -o ${tempDir}/BuildTools.jar https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
+  curl -fsSL -o "${tempDir}/BuildTools.jar" https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
     java $jvmOpts -jar ${tempDir}/BuildTools.jar --rev "$VERSION" 2>&1 |tee ${spigotBuildLog}| while read l; do echo -n .; done; log "done"
 
   case ${TYPE^^} in
diff --git a/scripts/start-utils b/scripts/start-utils
index 0aa8ada8..31a671bd 100755
--- a/scripts/start-utils
+++ b/scripts/start-utils
@@ -579,12 +579,24 @@ function extract() {
 
   case "${type}" in
   application/zip)
+    if unzip -Z1 "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     unzip -o -q -d "${destDir}" "${src}" "$@"
     ;;
   application/x-tar | application/gzip | application/x-gzip | application/x-bzip2)
+    if tar -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" -xf "${src}" "$@"
     ;;
   application/zstd | application/x-zstd)
+    if tar --use-compress-program=unzstd -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
+      logError "Refusing to extract $src because it contains path traversal entries"
+      return 1
+    fi
     tar -C "${destDir}" --use-compress-program=unzstd -xf "${src}" "$@"
     ;;
   *)