Skip to content

feat: TRAC-926 upgrade: project resolution, download, and base ref - #3065

Merged
chanceaclark merged 4 commits into
alphafrom
chancellorclark/ltrac-959-upgrade-project-resolution-download
Jun 26, 2026
Merged

feat: TRAC-926 upgrade: project resolution, download, and base ref#3065
chanceaclark merged 4 commits into
alphafrom
chancellorclark/ltrac-959-upgrade-project-resolution-download

test: TRAC-927 upgrade: command instance and integration tests

4d381b2
Select commit
Loading
Failed to load commit list.
DryRunSecurity / General Security Analyzer succeeded Jun 26, 2026 in 6s

DryRun Security

Details

General Security Analyzer Findings: 1 detected

⚠️ Path Traversal via Tar Extraction packages/catalyst/src/cli/commands/upgrade.ts (click for details)
Type Path Traversal via Tar Extraction
Description The downloadCore function uses tar to extract a tarball from a GitHub repository URL. While --strip-components=1 is used, it does not prevent path traversal attacks if the tarball contains malicious entries (e.g., ../../etc/passwd). The repository URL is configurable via the --repository flag, allowing users to specify arbitrary GitHub repositories. This could lead to arbitrary file writes outside the intended directory if a malicious repository is provided.
Filename packages/catalyst/src/cli/commands/upgrade.ts
CodeLink

catalyst/packages/catalyst/src/cli/commands/upgrade.ts

Lines 677 to 680 in c815131

await execa('tar', ['-xzf', tarballPath, '-C', rawDir, '--strip-components=1']);
// Source is expected to be the monorepo (core/ inside); fall back to the
// extracted root for a hypothetical flat-source tag (insurance, not a target).
View more details on DryRunSecurity