The GitHub Actions job "Dependency Review" on commons-compress.git/COMPRESS-727-secure-extractor has failed. Run started by GitHub user tomasilluminati (triggered by tomasilluminati).
Head commit for run: 4d04bcb23416db394fd41b50913eaf117ad5694b / tomasilluminati <[email protected]> [COMPRESS-727] Pin the lexical zip-slip guard, add UNC tests resolveWithinRoot decides containment from the name alone. Any file system call before Path#startsWith would touch an attacker-chosen location, and on Windows a UNC name would reach the network before the entry is rejected. The Javadoc now states that invariant. Tests pin it: a host/share name on every platform through ZipFile, ZipArchiveInputStream and tar, Windows-only UNC, drive and drive-relative spellings, and Windows illegal names that fail closed through the InvalidPathException wrapper. They accept only the guard's own ArchiveException, so a FileSystemException fails them. No logic change. Report URL: https://github.com/apache/commons-compress/actions/runs/35556889881 With regards, GitHub Actions via GitBox
