kermitt2 / grobid

41%

master: 40%

LAST BUILD ON BRANCH alert-autofix-39

branch: alert-autofix-39

CHANGE BRANCH

x

Reset

• alert-autofix-39
• 0.5.0
• 0.5.0-fixes
• 0.5.1
• 0.5.1-fixes
• 0.5.2
• 0.5.3
• 0.5.3-ISTEX
• 0.5.3-istex
• 0.5.4
• 0.5.4-fixes
• 0.5.5
• 0.5.6
• 0.5.6-fixes
• 0.6.0
• 0.6.0-fixes
• 0.6.1
• 0.6.2
• 0.7.0-test
• 0.7.1-fixes
• 0.7.3-fixes
• 0.8.0
• 0.8.0-fixes
• 0.8.1-fixes
• 0.8.2-fixes
• 3em-dash-support
• 512_PDF_and_authors_with_ORCID
• AcknowledgmentParser_Desir2ndCodeSprint
• GrobidModelRefactor
• add-developers-guide
• added_training_data_for_examples_highlights
• alert-autofix-41
• alert-autofix-61
• annotations-tmp
• architecture-parameter
• avoid-OOBE-when-truncated-delft-output
• batch-labeling-support
• better-citation-contexts
• biblio-glutton-v0.2
• bugfix/adjust-block-distance-when-multi-columns
• bugfix/adjust-discarded-notes-structure
• bugfix/adjust-notes-avoid-stackoverflow
• bugfix/avoid-dehypenisation-formula
• bugfix/avoid-empty-fig-ref-markers
• bugfix/avoid-empty-sentences
• bugfix/avoid-npe-when-unknown-pdf-annotation
• bugfix/configure-timeout-consolidation
• bugfix/correction-features-fulltext
• bugfix/crossref-api
• bugfix/delft-integration-experiments
• bugfix/download_button_for_text
• bugfix/dummy_model_NPE
• bugfix/fallback-flavor-to-standard
• bugfix/fix-coord-name-title
• bugfix/fix-date-normalisation
• bugfix/fix-doi-search
• bugfix/fix-dropped-misclassified-text
• bugfix/fix-e2e-flavor-param
• bugfix/fix-figure-table-ref
• bugfix/fix-figure-table-training-data-generation
• bugfix/fix-header-misclassification-dl
• bugfix/fix-jruby-update
• bugfix/fix-links-beginning-sent
• bugfix/fix-npe-empty-authors
• bugfix/fix-training-data-header
• bugfix/fix-training-figures-tables-generation
• bugfix/fix-training-generation-naming
• bugfix/fix-wrongly-assigned-day-consolidation
• bugfix/flavor-discarded-text
• bugfix/get-destination-when-available
• bugfix/header-layout-tokens-results
• bugfix/improved-doi-clean
• bugfix/inconsistent-figdesc
• bugfix/language-null
• bugfix/move-idno-under-analytics
• bugfix/notes-same-label
• bugfix/npe-when-empty-urls
• bugfix/paragraph-coords
• bugfix/problem-pr-559
• bugfix/remove-filtering-by-image-extension
• bugfix/reproduce-fix-table-problem
• bugfix/retrieve-dropped-text-figures
• bugfix/retrieve-dropped-text-figures-refill-as-paragraph
• bugfix/revise-evaluation
• bugfix/segmentation-training-data
• bugfix/sent-seg-ack-fund
• bugfix/sentence-segm-spaces-end
• bugfix/synchronisation-language-detection
• bugfix/table-notes
• bugfix/table-notes-sentence-segmentation
• bugfix/test-build-on-ci
• change-port-server-unittests
• check-evaluation
• citation-contexts
• config-patent
• copyright-stmt
• copyrights-licenses
• cors-configuration
• dataseer-variant
• deactivate-fuzzy-matching-config
• delft-0.3.0
• delft-debugging
• delft-integration
• desirtrack_coords
• docker-evaluation-image
• docu-fix
• document-serialization
• docx-support
• dropwizard-service
• dummy-model-for-test
• duplicated-abstract
• duplicated-body-parts-476
• element_pdf_coordinates_20150603
• elifesciences-back-section-figure-tables-upstream
• elifesciences-enable-travis-docker-build
• elifesciences-workaround-fulltext-npe
• elifesciences/extract-raw-affiliation-string-fork
• elifesciencesfix-fulltext-block-start
• enable-trivvy-code-scanning
• extend-docker
• feature/add-processing-parameters-in-response-header
• feature/add-start-end-page-header
• feature/add-styles-xml
• feature/add-training-data
• feature/add-training-data-remove-caption-fix
• feature/allow-absolute-tmp
• feature/change-base-image-delft-docker
• feature/coi-ac
• feature/collect-discarded-data
• feature/data-availability-statement
• feature/distinguish-when-consolidated-citations
• feature/docker-evaluation-image
• feature/enable-env-variables
• feature/extend-arm-support
• feature/extract-any-url-in-fulltext
• feature/funding-statement
• feature/github-actions
• feature/identify-urls
• feature/improving-sentence-segmentation
• feature/kotlin
• feature/literature-law-flavour
• feature/literature-law-flavour-old-pdfalto
• feature/paragraphs-coordinates
• feature/patent-process
• feature/preserve-urls
• feature/randomise-model-name-during-nfold
• feature/segmentation-light
• feature/segmentation-light_das_training
• feature/support-mac-arm
• feature/timeout_pdfalto_server
• feature/training-data-aaas
• feature/update_jdk_and_gradle
• feature/update_jep
• feature/upgrade-dropwizard
• feature/wapiti-algorithm-selection
• features/create-training-via-api
• features/footnotes
• fix-#710
• fix-1036
• fix-712
• fix-811
• fix-867
• fix-automatic-full-image
• fix-crossref-plus-token
• fix-doc
• fix-note-page
• fix-url-extraction-regex-shorter
• fix-vector-graphics
• fix-vulnerabilities
• fix_crossref_multi-thread
• fix_crossref_multithread
• fixes-n-fold-evaluation
• flavor
• from05072016
• from05072016-2
• funders-and-funding
• glutton-0.3
• gradle-jep-path
• gradle5
• grobid-0.5.6
• grobid-lucene-analyzers
• grobid-parent-0.3.4
• grobid-parent-0.3.5
• grobid-parent-0.3.6
• grobid-parent-0.3.7
• grobid-parent-0.3.8
• grobid-parent-0.4.1
• grobid-parent-0.4.2
• grobid-parent-0.4.3
• grobid-parent-0.4.3-fixes
• grobid-parent-0.4.4
• grobid-parent-0.4.4-fixes
• grobid_config_20150825
• haydn-jones-annotations
• header-model-eval
• header_author_layout_tokens
• improved-dehypenisation
• improved-dockerfile-delft
• improvement/add-tests-sentence-segmentation
• improvement/allocate-more-memory-java
• improvement/better-simpler-documentation
• improvement/create-training-keep-orignial-file-name
• improvement/e2e-automatic-lower-nb-threads
• improvement/jep-init-error-display
• improvement/jep-init-error-handling
• improvement/no-cache-pip
• improvement/remove-log-on-file-docker
• improvement/revise-dl-interaction
• improvement/strongly-typed-engine-factory
• improvement/update-interface-doc
• improvement/update-jep
• improvements/resolve-deprecations
• incremental-training
• jcboyd-pykelet-PR-consortium_collaboration
• jcboyd-pykelet-PR-segmentation
• jcboyd-pykelet-PR-segmentation_referenceSegmenter
• keep_affiliations_after_consolidation
• layout_utils
• lfoppiano_refactor_utilities_Methods-040816
• line_number_support
• lucbouge-patch-1
• martin-citation-annotations
• mastak-feature/docker
• master
• minor-correction-properties
• model-initialisation-fix
• modified-pdf2xml
• monographe-opaline
• multi-arch-docker-image
• names_address_parser
• new-figure-table-models
• new-training-data-das
• option-442
• option-consolidate-with-doi-only
• orcid_author_header_model_annotation
• partial-merge-pr-216
• patrice-23012016
• patrice-24012016
• pdf_md5
• pdfalto_integration
• pdfalto_parser_fixes
• pre-release-0.8.0
• python-envs
• reading-order
• reduce-image-size
• reference_marker_matcher
• release-0.8.1
• research-infrastructures
• revert-624-bugfix/crossref-api
• review-patent
• sentence-segmentation
• sentence-segmentation-detection
• standalone-figure-extraction
• supercript-feature-in-fulltext
• support-cjk-langs
• taggingLabel-issue133
• tensorflow-2.16
• test-jvm-crash
• test/change-config
• test/change-log-level
• tokenLayouts20151026
• update-affiliation
• update-analyzers-lib
• update-doc
• update-pdfalto-recognition
• update-regexes-urls
• update-stats
• update_header
• updated-dependencies
• usage-embedded-pdf-metadata-485
• vipulg13-master
• yaml-config
• yaml-config-bis

Build # 12706490680

Build Type

Pull #1225

github

Committed by web-flow

Commit Message

Fix code scanning alert no. 39: Arbitrary file access during archive extraction ("Zip Slip")

Fix the possibility that someone would download a sneaky grobid home which will be used to write arbitrary files outside the designated temporary directory

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Pull Request Pull Request #1225: Fix code scanning alert no. 39: Arbitrary file access during archive extraction ("Zip Slip")

Run Details

7975 of 23139 branches covered (34.47%)

16727 of 40973 relevant lines covered (40.82%)

1.67 hits per line