Skip to:
https://github.com/folio-org/mod-orders-storage/security/code-scanning/1 reports Arbitrary file access during archive extraction ("Zip Slip") (= https://cwe.mitre.org/data/definitions/22.html ) for https://github.com/folio-org/mod-orders-storage/blob/v13.7.2/src/main/java/org/folio/util/PomReaderUtil.java
Fix:
Use ModuleName.java instead that RMB’s domain-models-maven-plugin automatically generates. This allows to delete the duplicated code in PomReaderUtil.java and PomReaderUtilTest.java that has been copied from RMB: https://github.com/folio-org/raml-module-builder/blob/v35.2.0/domain-models-maven-plugin/src/main/java/org/folio/rest/tools/PomReader.java
Merged https://github.com/folio-org/mod-orders-storage/pull/419 , thanks for the fix, closing this ticket
https://github.com/folio-org/mod-orders-storage/security/code-scanning/1
reports Arbitrary file access during archive extraction ("Zip Slip") (= https://cwe.mitre.org/data/definitions/22.html ) for https://github.com/folio-org/mod-orders-storage/blob/v13.7.2/src/main/java/org/folio/util/PomReaderUtil.java
Fix:
Use ModuleName.java instead that RMB’s domain-models-maven-plugin automatically generates. This allows to delete the duplicated code in PomReaderUtil.java and PomReaderUtilTest.java that has been copied from RMB: https://github.com/folio-org/raml-module-builder/blob/v35.2.0/domain-models-maven-plugin/src/main/java/org/folio/rest/tools/PomReader.java