cenkalti / rain / 27305470322

41%

push

github

use canonical prefix guard for tar-slip check so CodeQL recognizes it

The previous guard combined the containment check with a name != dir
disjunction, leaving the sanitized branch as (name == dir || HasPrefix),
which CodeQL's zipslip/path-injection queries do not treat as a barrier.
generateTar only emits regular files nested under the data dir, so no
legitimate entry ever equals dir; drop the disjunction and keep the plain
HasPrefix(dir+separator) guard. Same protection, recognized as a sanitizer.

0 of 5 new or added lines in 1 file covered. (0.0%)

3774 of 11778 relevant lines covered (32.04%)

47.29 hits per line