Go Module github.com/mholt/archiver/v3 Flagged with High Security Vulnerability

[stevesim101]

Describe the bug
When trying to use the JFrog Go client, my company's enterprise SCA platform is flagging github.com/mholt/archiver/v3 with a high security vulnerability.

https://securitylab.github.com/advisories/GHSL-2020-252-zipslip-archiver

I was wondering if you could share your short-term or long-term plans to address this. Even if there is no immediate fix, I just need some insight on the current and future state of this to provide a bit of context to my company's compliance teams.

To Reproduce
N/A

Expected behavior
N/A

Screenshots
N/A

Versions

• JFrog Go client version: v1.4.0
• JFrog Go client operating system:
• Artifactory version:

Additional context
Add any other context about the problem here.

[yahavi]

@stevesim101
Thanks for reporting this issue.
It looks like the Archiver maintainer won't going to fix this issue. see "Security note" under https://github.com/mholt/archiver#library-use. However, we do have plans to replace Unarchive with Walk as advised by the maintainer. Using Walk, we should be able to sanitized and extract the archive entries safely.

We'll let you know once this issue is fixed.

[stevesim101]

Thank you @yahavi for the update!

[yahavi]

@stevesim101,
We merged #433 to the dev branch.
From the next version, archives will be sanitized before extraction.
We'll keep you updated.

[stevesim101]

Thanks @yahavi!