- Sponsor
-
Notifications
You must be signed in to change notification settings - Fork 185
Permalink
Choose a base ref
{{ refName }}
default
Choose a head ref
{{ refName }}
default
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
base repository: isaacs/node-tar
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: a044a87c6c7fb3ace4ea9bf903c63f0f15965398
Could not load branches
Nothing to show
Loading
Could not load tags
Nothing to show
{{ refName }}
default
Loading
...
head repository: isaacs/node-tar
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 3302cf7330052982ad7d7e9f85e823fa1bb945a4
Could not load branches
Nothing to show
Loading
Could not load tags
Nothing to show
{{ refName }}
default
Loading
- 9 commits
- 12 files changed
- 5 contributors
Commits on Dec 10, 2022
-
chore: bump @npmcli/template-oss from 4.10.0 to 4.11.0
Bumps [@npmcli/template-oss](https://github.com/npm/template-oss) from 4.10.0 to 4.11.0. - [Release notes](https://github.com/npm/template-oss/releases) - [Changelog](https://github.com/npm/template-oss/blob/main/CHANGELOG.md) - [Commits](npm/template-oss@v4.10.0...v4.11.0) --- updated-dependencies: - dependency-name: @npmcli/template-oss dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Configuration menu - View commit details
-
Copy full SHA for 5f31636 - Browse repository at this point
Copy the full SHA 5f31636View commit details -
Configuration menu - View commit details
-
Copy full SHA for 82bb328 - Browse repository at this point
Copy the full SHA 82bb328View commit details
Commits on Apr 12, 2023
-
Configuration menu - View commit details
-
Copy full SHA for 75d3081 - Browse repository at this point
Copy the full SHA 75d3081View commit details
Commits on May 2, 2023
-
PR-URL: #381 Credit: @wraithgar Close: #381 Reviewed-by: @isaacs
Configuration menu - View commit details
-
Copy full SHA for 4cbdd67 - Browse repository at this point
Copy the full SHA 4cbdd67View commit details -
Configuration menu - View commit details
-
Copy full SHA for 4aaffc8 - Browse repository at this point
Copy the full SHA 4aaffc8View commit details
Commits on May 12, 2023
-
move mutateFS reset out of t.teardown
Not sure why this was failing on my system, but this fixes it.
Configuration menu - View commit details
-
Copy full SHA for 8cd8139 - Browse repository at this point
Copy the full SHA 8cd8139View commit details -
Configuration menu - View commit details
-
Copy full SHA for 24efc74 - Browse repository at this point
Copy the full SHA 24efc74View commit details
Commits on May 17, 2023
-
Normalize unicode internally using NFD
Previously, the path reservation system, which defends against unicode path name collisions (the subject of a handful of past CVE issues), was using NFKD normalization internally to determine of two paths would be likely to reference the same file on disk. This has the weird effect of normalizing things like `℀` into simple decomposed character strings, for example `a/c`. These can contain slashes and double-dot sections, which means that the path reservations may end up reserving more (or different) paths than intended. Thankfully, tar was already *extracting* properly, even if the path reservations collided, and these collisions resulted in tar being *more* aggressive than it should be in restricting parallel extraction, rather than less. That's a good direction to err in, for security, but also, made tar less efficient than it could be in some edge cases. Using NFD normalization, unicode characters are not decomposed in compatibility mode, but still result in matching path reservation keys as intended. This does not cause any change in observed behavior, other than allowing some files to be extracted in parallel where it is provably safe to do so. Credit: discovered by @Sim4n6. This did not result in a juicy security vulnerability, but it sure looked like one at first. They were extremely patient, thorough, and persistent in trying to pin this down to a POC and CVE. There is very little reward or visibility when a security researcher finds a bug that doesn't result in a security disclosure, but the attempt often results in improvements to the project.
Configuration menu - View commit details
-
Copy full SHA for 4501bdb - Browse repository at this point
Copy the full SHA 4501bdbView commit details -
Configuration menu - View commit details
-
Copy full SHA for 3302cf7 - Browse repository at this point
Copy the full SHA 3302cf7View commit details
There are no files selected for viewing