amorfo77/docker-minecraft-server
1
0
Fork 0
mirror of https://github.com/itzg/docker-minecraft-server.git synced 2026-08-30 10:47:15 +00:00
Code Issues Projects Releases Wiki Activity

pin gosu, fail closed on BuildTools download, reject zip slip (#4247)

Browse Source
This commit is contained in:
LCB
2026-08-27 12:38:41 -05:00
committed by GitHub
parent 6417a93920
commit 6d6c99ff6b
3 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/start-deployBukkitSpigot
+1 -1
View File
@@ -43,7 +43,7 @@ function buildSpigotFromSource {
fi
logn ''
curl -sSL -o ${tempDir}/BuildTools.jar https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
curl -fsSL -o "${tempDir}/BuildTools.jar" https://hub.spigotmc.org/jenkins/job/BuildTools/lastSuccessfulBuild/artifact/target/BuildTools.jar && \
java $jvmOpts -jar ${tempDir}/BuildTools.jar --rev "$VERSION" 2>&1 |tee ${spigotBuildLog}| while read l; do echo -n .; done; log "done"
case ${TYPE^^} in
scripts/start-utils
+12
View File
@@ -579,12 +579,24 @@ function extract() {
case "${type}" in
application/zip)
if unzip -Z1 "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
logError "Refusing to extract $src because it contains path traversal entries"
return 1
fi
unzip -o -q -d "${destDir}" "${src}" "$@"
;;
application/x-tar | application/gzip | application/x-gzip | application/x-bzip2)
if tar -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
logError "Refusing to extract $src because it contains path traversal entries"
return 1
fi
tar -C "${destDir}" -xf "${src}" "$@"
;;
application/zstd | application/x-zstd)
if tar --use-compress-program=unzstd -tf "${src}" | grep -qE '(^/)|(^\.\./)|(/\.\./)|(/\.\.$)'; then
logError "Refusing to extract $src because it contains path traversal entries"
return 1
fi
tar -C "${destDir}" --use-compress-program=unzstd -xf "${src}" "$@"
;;
*)