kumquat-buildroot/utils
Peter Korsgaard a83e30ad63 utils/scanpypi: protect against zip-slip vulnerability in zip/tar handling
For details, see https://github.com/snyk/zip-slip-vulnerability

Older python versions do not validate that the extracted files are inside
the target directory.  Detect and error out on evil paths before extracting
.zip / .tar file.

Given the scope of this (zip issue was fixed in python 2.7.4, released
2013-04-06, scanpypi is only used by a developer when adding a new python
package), the security impact is fairly minimal, but it is good to get it
fixed anyway.

Reported-by: Bas van Schaik <security-reports@semmle.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-02-12 21:27:35 +01:00
..
checkpackagelib utils/check-package: warn about overridden variables 2019-02-05 20:24:57 +01:00
brmake
check-package
config
diffconfig
genrandconfig utils/genrandconfig: drop qt4 fixups 2019-02-06 16:30:39 +01:00
get-developers
getdeveloperlib.py
readme.txt
scancpan
scanpypi utils/scanpypi: protect against zip-slip vulnerability in zip/tar handling 2019-02-12 21:27:35 +01:00
size-stats-compare
test-pkg

This directory contains various useful scripts and tools for working
with Buildroot. You need not add this directory in your PATH to use
any of those tools, but you may do so if you want.

brmake
    a script that can be run instead of make, that prepends the date in
    front of each line, redirects all of the build output to a file
    ("'br.log' in the current directory), and just outputs the Buildroot
    messages (those lines starting with >>>) on stdout.
    Do not run this script for interactive configuration (e.g. menuconfig)
    or on an unconfigured directory. The output is redirected so you will see
    nothing.

check-package
    a script that checks the coding style of a package's Config.in and
    .mk files, and also tests them for various types of typoes.

genrandconfig
    a script that generates a random configuration, used by the autobuilders
    (http://autobuild.buildroot.org). It selects a random toolchain from
    support/config-fragments/autobuild and randomly selects packages to build.

get-developpers
    a script to return the list of people interested in a specific part
    of Buildroot, so they can be Cc:ed on a mail. Accepts a patch as
    input, a package name or and architecture name.

scancpan
    a script to create a Buildroot package by scanning a CPAN module
    description.

scanpypi
    a script to create a Buildroot package by scanning a PyPI package
    description.

size-stats-compare
    a script to compare the rootfs size between two different Buildroot
    configurations. This can be used to identify the size impact of
    a specific option, of a set of specific options, or of an update
    to a newer Buildroot version...

test-pkg
    a script that tests a specific package against a set of various
    toolchains, with the goal to detect toolchain-related dependencies
    (wchar, threads...)