SonarSource/sonar-scanner-msbuild

JRE provisioning: Harden against Zip bomb attack

martin-strecker-sonarsource opened this issue · 0 comments

The JRE provisioning is vulnerable against zip bomb attacks in the ZipUnpacker and the TarGzUnpacker implementations.
For details see the security hotspot for rule S5042 in ZipUnpacker's use of zipArchive.ExtractToDirectory.