asar icon indicating copy to clipboard operation
asar copied to clipboard

Published 20 hours ago • verified publisher icon electron

asar not verifying filenames before passing them to minimatch

Open Stanzilla opened this issue 2 years ago • 0 comments

While working on tracking down a bug with sharp, we found that asar is not verifying file names before passing them to its minimatch dependency.

electron/asar@94cb8bd/lib/asar.js#L123

isaacs/minimatch@6410ef3/minimatch.js#L128

Stanzilla avatar Jun 11 '22 18:06 Stanzilla