Skip to content

FPD (Full Path Disclosure) of TMPDIR directory in output in JSON differences from inside archive

a FPD (Full Path Disclosure) issue exists which leak the path of TMPDIR When comparing archives that contain JSON files, such as zipping files in issue: #194 and comparing them will result in: (/srv/storage.try.diffoscope.org/ is leaked)

│ +1 file, 13212 bytes uncompressed, 1734 bytes compressed:  86.9%
├── zipnote {}
│ @@ -1,4 +1,4 @@
│ -Filename: 1default_config.json
│ +Filename: 2default_config.json
│  Comment: 

│  Zip file comment:
│   --- 1default_config.json
├── +++ 2default_config.json
│ │   --- /srv/storage.try.diffoscope.org/sukqfcvhvuht/diffoscope_0b8putxu/tmps5ajzvcq/1default_config.json
│ ├── +++ /srv/storage.try.diffoscope.org/sukqfcvhvuht/diffoscope_0b8putxu/tmpe84ss4ym/2default_config.json
│ │┄ Differences: {

fix: same as done for similar issue #126 (closed) in commit 151b2260

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information