opendefensecloud / solution-arsenal / 29314540334
81%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 65
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 81.303% (+0.08%) from 81.228%
29314540334

push

github

web-flow 
fix(deps): update module oras.land/oras-go/v2 to v2.6.2 [security] (#696)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| oras.land/oras-go/v2 | `v2.6.1` → `v2.6.2` |
![age](https://developer.mend.io/api/mc/badges/age/go/oras.land%2foras-go%2fv2/v2.6.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/oras.land%2foras-go%2fv2/v2.6.1/v2.6.2?slim=true)
|

---

### `oras-go` tar extraction: Hardlink entry with relative Linkname
escapes extract dir via process CWD resolution
[CVE-2026-50163](https://nvd.nist.gov/vuln/detail/CVE-2026-50163) /
[GHSA-fxhp-mv3v-67qp](https://redirect.github.com/advisories/GHSA-fxhp-mv3v-67qp)

<details>
<summary>More information</summary>

#### Details
##### Root cause

The tar-extraction helper `ensureLinkPath` at
[`content/file/utils.go:262-275`](https://redirect.github.com/oras-project/oras-go/blob/main/content/file/utils.go#L262-L275)
validates that a hardlink's target resolves inside the extract base, but
then returns the original unresolved `target` string back to the caller:

```go
func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) {
    path := target
    if !filepath.IsAbs(target) {
        path = filepath.Join(filepath.Dir(link), target)  // resolved FOR VALIDATION
    }
    if _, err := resolveRelToBase(baseAbs, baseRel, path); err != nil {
        return "", err
    }
    return target, nil   // <-- returns the ORIGINAL target, not the validated path
}
```

The caller for `TypeLink` hardlinks then does:

```go
case tar.TypeLink:
    var target string
    if target, err = ensureLinkPath(dirPath, dirName, filePath, header.Linkname); err == nil {
        err = os.Link(target, filePath)
    }
```

`os.Link(oldname, newname)` wraps the `link(2)` system call. From the
`link(2)` man page:

> oldpath and newpath are ... (continued)

4344 of 5343 relevant lines covered (81.3%)

36.55 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
89.09
 -1.82% pkg/discovery/runner.go
Jobs
ID Job ID Ran Files Coverage
1 29314540334.1 65
81.3
 GitHub Action Run
Source Files on build 29314540334