storytold/craft-launcher
2
0
Fork 0
mirror of https://github.com/storytold/craft-launcher.git synced 2026-11-02 18:07:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

deps: bump tar, zip, roxmltree, rustls-webpki and symphonia to their latest versions (#1036)

Browse Source 
- `rustls-webpki`: 0.103.15 → 0.103.16
- `zip`: 8.6.0, 9.1.0 → 9.1.3

Requirement `zip` 8 → 9. The portable-ZIP check now treats an entry name that doesn't decode as unsafe, like one with `\\` or `:`. That code is Windows-only and wasn't compiled here (Linux); Windows CI is the check.
This commit is contained in:
Dylan M. Taylor
2026-10-29 22:21:27 -04:00
committed by GitHub
parent 8ffceca5f0
commit 3fad1d643f
3 changed files with 21 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
+18 -38
View File
@@ -253,7 +253,7 @@ dependencies = [
"objc2-foundation 0.3.2",
"parking_lot",
"percent-encoding",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
"wl-clipboard-rs",
"x11rb",
]
@@ -327,7 +327,7 @@ dependencies = [
"verifysign",
"winreg",
"winsafe",
"zip 8.6.0",
"zip",
]
[[package]]
@@ -881,7 +881,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
dependencies = [
"lazy_static",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -1042,7 +1042,7 @@ dependencies = [
"verifysign",
"winreg",
"winsafe",
"zip 9.1.0",
"zip",
]
[[package]]
@@ -1203,7 +1203,7 @@ dependencies = [
"libc",
"option-ext",
"redox_users",
"windows-sys 0.61.2",
"windows-sys 0.59.0",
]
[[package]]
@@ -1574,7 +1574,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
dependencies = [
"libc",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -3538,7 +3538,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
dependencies = [
"libc",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -4212,7 +4212,7 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys 0.4.15",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -4225,7 +4225,7 @@ dependencies = [
"errno",
"libc",
"linux-raw-sys 0.12.1",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -4282,7 +4282,7 @@ dependencies = [
"security-framework",
"security-framework-sys",
"webpki-root-certs",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -4293,9 +4293,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
[[package]]
name = "rustls-webpki"
version = "0.103.15"
version = "0.103.16"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
dependencies = [
"ring",
"rustls-pki-types",
@@ -4782,10 +4782,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
dependencies = [
"fastrand",
"getrandom 0.4.3",
"getrandom 0.3.4",
"once_cell",
"rustix 1.1.5",
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -5097,12 +5097,6 @@ dependencies = [
"rustc-hash 2.1.3",
]
[[package]]
name = "typed-path"
version = "0.12.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
[[package]]
name = "typed-path"
version = "0.13.0"
@@ -5794,7 +5788,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.52.0",
"windows-sys 0.59.0",
]
[[package]]
@@ -6449,23 +6443,9 @@ dependencies = [
[[package]]
name = "zip"
version = "8.6.0"
version = "9.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
dependencies = [
"crc32fast",
"flate2",
"indexmap",
"memchr",
"typed-path 0.12.3",
"zopfli",
]
[[package]]
name = "zip"
version = "9.1.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2886b00003a72c4ccee3f42cfc34908d33b2508a74d827dc2a4244706475c704"
checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
dependencies = [
"crc32fast",
"flate2",
@@ -6473,7 +6453,7 @@ dependencies = [
"indexmap",
"memchr",
"nix",
"typed-path 0.13.0",
"typed-path",
"windows-sys 0.61.2",
"zopfli",
]
crates/native/Cargo.toml
+1 -1
View File
@@ -45,7 +45,7 @@ plist = "1"
winreg = "0.55"
# Resolves junctions/symlinks without forcing short MSI paths into the verbatim namespace.
dunce = "1"
zip = { version = "8", default-features = false, features = ["deflate"] }
zip = { version = "9", default-features = false, features = ["deflate"] }
# Safe wrappers for waiting for another process and reading a file's VERSIONINFO.
winsafe = { version = "0.0.29", features = ["kernel", "version"] }
# Authenticode checks through WinTrust: the update helper installs only files from the launcher's publisher.
crates/native/src/portable.rs
+2 -1
View File
@@ -133,7 +133,8 @@ fn extract(file: &Path, destination: &Path) -> Result<(Vec<PathBuf>, Vec<PathBuf
let mut entry = archive.by_index(index).map_err(|e| e.to_string())?;
let relative = entry.enclosed_name().ok_or("The portable ZIP contains an unsafe path.")?;
if relative.components().any(|c| !matches!(c, Component::Normal(_)))
|| entry.name().contains(['\\', ':'])
// zip 9: a name that doesn't decode is as unsafe as one with `\` or `:`.
|| entry.name().map_or(true, |name| name.contains(['\\', ':']))
|| entry.unix_mode().is_some_and(|mode| mode & 0o170000 == 0o120000)
{
return Err("The portable ZIP contains an unsafe path or link.".into());