Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support gcloud structured logging #425

Closed
etanshaul opened this issue Jun 20, 2017 · 0 comments · Fixed by #426
Closed

Support gcloud structured logging #425

etanshaul opened this issue Jun 20, 2017 · 0 comments · Fixed by #426
Assignees
@etanshaul

Comments

@etanshaul
Copy link
Contributor

Release 159 added support for structured output logging.

The library should add support so that clients can consume and parse these as needed.
@etanshaul etanshaul self-assigned this Jun 20, 2017
@etanshaul etanshaul mentioned this issue Jun 21, 2017
Merged
JoeWang1127 pushed a commit that referenced this issue Nov 29, 2023
@loosebazooka
Update docs for 2.3.0 (#425)
efe190f
JoeWang1127 pushed a commit that referenced this issue Nov 29, 2023
@JLLeitschuh @TeamModerne
vuln-fix: Zip Slip Vulnerability (#425)
af67f06 
This fixes a Zip-Slip vulnerability.

This change does one of two things. This change either

1. Inserts a guard to protect against Zip Slip.
OR
2. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.

For number 2, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.

Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: High
CVSSS: 7.4
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-zipslip/) & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.ZipSlip)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#16


Co-authored-by: Moderne <[email protected]>

Co-authored-by: Moderne <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@etanshaul etanshaul

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Adds CloudSdk parameter for setting structured logs value GoogleCloudPlatform/appengine-plugins
1 participant
@etanshaul