Cleanups from PR review#1813
Conversation
Signed-off-by: Natalie Arellano <narellano@vmware.com>
github-actions
Bot
added
the
type/enhancement
Signed-off-by: Natalie Arellano <narellano@vmware.com>
github-actions
Bot
added
the
type/chore
Signed-off-by: Natalie Arellano <narellano@vmware.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ) | ||
|
|
||
| for { | ||
| header, err = tr.Next() |
Check failure
Code scanning / CodeQL
Arbitrary file write during zip extraction ("zip slip")
Signed-off-by: Natalie Arellano <narellano@vmware.com>
Signed-off-by: Natalie Arellano <narellano@vmware.com>
| // write the rest of the package | ||
| var header *tar.Header | ||
| for { | ||
| header, err = tr.Next() |
Check failure
Code scanning / CodeQL
Arbitrary file write during zip extraction ("zip slip")
| if origVersion == "" { | ||
| // the first header only contains the id - e.g., /cnb/buildpacks/<buildpack-id>, | ||
| // read the next header to get the version | ||
| secondHeader, err := tr.Next() |
Check failure
Code scanning / CodeQL
Arbitrary file write during zip extraction ("zip slip")
natalieparellano
force-pushed
the
fix/flatten-tar-extras-3
branch
3 times, most recently
from
a2b867e to
d43dfb9
Compare
Signed-off-by: Natalie Arellano <narellano@vmware.com>
natalieparellano
force-pushed
the
fix/flatten-tar-extras-3
branch
from
0fc0ae4 to
84ee822
Compare
|
Finally all the tests are passing (though Codecov & CodeQL are not happy): https://github.com/buildpacks/pack/actions/runs/5394788057/jobs/9796440626?pr=1813 I'll point this back to the feature branch for @jjbustamante to review... |
| if !module.ContainsFlattenedModules() { | ||
| return handleSingleOrEmptyModule(dest, module) | ||
| } |
There was a problem hiding this comment.
The recursive function can handle the case where the module contains a single buildpack
Signed-off-by: Natalie Arellano <narellano@vmware.com>
github-actions
Bot
removed
the
type/chore
| } | ||
| if desc.Info().Match(md.ModuleInfo) { // This is the order buildpack of the package | ||
| if desc.Info().Match(md.ModuleInfo) { // Current module is the order buildpack of the package | ||
| mainBP = FromBlob(&desc, b, blobOpts...) |
There was a problem hiding this comment.
Because we are removing method ContainsFlattenedModules(), I think we can also remove the BlobOption
3 participants
Hopefully simplifying some things from #1787 (pointing to main for now, just to see the tests run)