Jacques Le Roux created OFBIZ-12056:
---------------------------------------
Summary: Prevent Zip Slip vulnerability
Key: OFBIZ-12056
URL: https://issues.apache.org/jira/browse/OFBIZ-12056
Project: OFBiz
Issue Type: Sub-task
Components: framework/base
Affects Versions: Trunk
Reporter: Jacques Le Roux
While working with FileUtil::unzipFileToFolder I noticed that it's vulnerable
to Zip slip vulnerability: https://snyk.io/research/zip-slip-vulnerability.
Fortunately OOTB code does not use FileUtil::unzipFileToFolder so I did not
create a CVE, nor reported to
https://github.com/snyk/zip-slip-vulnerability#user-content-projects-affected-and-fixed.
If you think we should please shime in...
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
