Unclaimed project
Are you a maintainer of zvm? Claim this project to take control of your public changelog and roadmap.
Changelog
zvm (Zig Version Manager) lets you easily install/upgrade between different versions of Zig.
Full Changelog: https://github.com/tristanisham/zvm/compare/v0.8.10...v0.8.11
feat(security): Implement robust path and archive extraction safeguards
This commit addresses several security vulnerabilities related to path traversal and insecure archive extraction.
Introduced os.OpenRoot for file system operations in getVersion and Uninstall functions. This confines all file access to the designated base directory, effectively mitigating path traversal vulnerabilities that could lead to:
arbitrary code execution (via zvm use / run / sync)
arbitrary file deletion (via zvm uninstall)
Enhanced the untar function with explicit path validation using filepath.Abs and strings.HasPrefix. This ensures that files extracted during the upgrade process cannot be written outside the intended temporary directory, protecting against arbitrary file writes from a malicious tarball.