Skip to content

1.11.3.md

Latest commit

 

History

History
5 lines (3 loc) · 415 Bytes

1.11.3.md

File metadata and controls

5 lines (3 loc) · 415 Bytes
Raw

1.11.3

Minor Analysis Improvements

  • The java/zipslip query no longer reports archive entry names that flow only to read-only path sinks such as ClassLoader.getResource, FileInputStream, and FileReader. The query now restricts its sinks to the path-injection kind and deliberately excludes the new path-injection[read] sub-kind, matching the Zip Slip threat model of unsafe archive extraction.