toolkit
toolkit copied to clipboard
actions
Limit files extracted by restoreCache to those in paths option.
Not filtering extracted archive files enables widely scoped cache poisoning attack in which attacker can clobber pretty much any file they want. This was exploited in https://github.com/ultralytics/ultralytics/issues/18027 for example.
