chore: update vulnerable go dependencies (#938)

* upgrade * upgrade * revert gems * revert * upgrade to the latest vers * revert * revert * partial upgrade * revert partial upgrade * archiver (depr) -> archive/zip * ignore DS_Store * remove unused ref * revert unneeded upgrades * run go mod tidy * make code more robust * upgrade testify and sprig * more upgrades * more upgrades * more upgrades * upgrade pterm * revert * test upgrading certain modules only * expr upgrade * upgrade copy * upgrade godirwalk * downgrade godirwalk, upgrade others * change expr * revert yaml * fix pterm and godirwalk vers * downgrade godirwalk * upgrade back godirwalk * go mod tidy * remove godirwalk entirely and use filepath instead * minor upgrades * check os.MkdirAll * no redeclaring err * mkdirall -> mkdir * ran goimport * simplify syntax * redeclare error to satisfy linting req * fix err shadowing * path traversal * remove path traversal * try mholt archives * remove unused zip dep * remove linkErr shadowing * run goimport * rename unused context as _ * revert to archive again * file traversal error remove * limit decompression size * increase copy size * revert filepath join * change filepath, revert io copy * add limit reader * change to 10 GB size limit * change to CopyN * revert back to Copy * go mod tidy
errata-ai · Jan 14, 2025 · e73f5cd · e73f5cd
1 parent c58806e
commit e73f5cd
Showing 10 changed files with 193 additions and 254 deletions.
diff --git a/.gitignore b/.gitignore
@@ -23,6 +23,8 @@ fixtures/formats/Sphinx/_build/
 
 .release-env
 
+.DS_Store
+
 # Files
 *.o
 *.a

diff --git a/cmd/vale/api.go b/cmd/vale/api.go
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/mholt/archiver/v3"
 	"github.com/spf13/pflag"
 
 	"github.com/errata-ai/vale/v3/internal/core"
@@ -81,7 +80,7 @@ func fetch(src, dst string) error {
 	}
 
 	resp.Body.Close()
-	return archiver.Unarchive(tmpfile.Name(), dst)
+	return unarchive(tmpfile.Name(), dst)
 }
 
 func install(args []string, flags *core.CLIFlags) error {

diff --git a/cmd/vale/sync.go b/cmd/vale/sync.go
@@ -6,7 +6,6 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/mholt/archiver/v3"
 	cp "github.com/otiai10/copy"
 
 	"github.com/errata-ai/vale/v3/internal/core"
@@ -62,7 +61,7 @@ func loadLocalZipPkg(name, pkgPath, styles string, index int) error {
 		return err
 	}
 
-	if err = archiver.Unarchive(pkgPath, dir); err != nil {
+	if err = unarchive(pkgPath, dir); err != nil {
 		return err
 	}
 

diff --git a/cmd/vale/util.go b/cmd/vale/util.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"archive/zip"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -93,3 +94,49 @@ func mkdir(dir string) error {
 func toCodeStyle(s string) string {
 	return pterm.Fuzzy.Sprint(s)
 }
+
+func unarchive(src, dest string) error {
+	r, err := zip.OpenReader(src)
+	if err != nil {
+		return err
+	}
+	defer r.Close()
+
+	if err = mkdir(dest); err != nil {
+		return err
+	}
+
+	for _, file := range r.File {
+		destPath := filepath.Join(dest, filepath.Clean(file.Name))
+		if !strings.HasPrefix(destPath, filepath.Clean(dest)+string(os.PathSeparator)) {
+			return fmt.Errorf("invalid file path: %s", file.Name)
+		}
+
+		if file.FileInfo().IsDir() {
+			if err = mkdir(destPath); err != nil {
+				return err
+			}
+			continue
+		}
+		if err = mkdir(filepath.Dir(destPath)); err != nil {
+			return err
+		}
+
+		dstFile, dstErr := os.OpenFile(destPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, file.Mode())
+		if dstErr != nil {
+			return dstErr
+		}
+		defer dstFile.Close()
+
+		srcFile, srcErr := file.Open()
+		if srcErr != nil {
+			return srcErr
+		}
+		defer srcFile.Close()
+
+		if _, err = io.Copy(dstFile, io.LimitReader(srcFile, 1024*1024*1024*10)); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/go.mod b/go.mod
@@ -3,72 +3,58 @@ module github.com/errata-ai/vale/v3
 go 1.23.2
 
 require (
-	github.com/Masterminds/sprig/v3 v3.2.3
-	github.com/adrg/strutil v0.3.0
-	github.com/adrg/xdg v0.4.0
-	github.com/antonmedv/expr v1.12.0
-	github.com/bmatcuk/doublestar/v4 v4.6.0
-	github.com/d5/tengo/v2 v2.10.0
+	github.com/Masterminds/sprig/v3 v3.3.0
+	github.com/adrg/strutil v0.3.1
+	github.com/adrg/xdg v0.5.3
+	github.com/bmatcuk/doublestar/v4 v4.7.1
+	github.com/d5/tengo/v2 v2.17.0
 	github.com/errata-ai/ini v1.63.0
 	github.com/errata-ai/regexp2 v1.7.0
+	github.com/expr-lang/expr v1.16.9
 	github.com/gobwas/glob v0.2.3
 	github.com/jdkato/go-tree-sitter-julia v0.1.0
 	github.com/jdkato/twine v0.10.1
-	github.com/karrick/godirwalk v1.16.1
-	github.com/mholt/archiver/v3 v3.5.1
-	github.com/mitchellh/mapstructure v1.4.0
-	github.com/niklasfasching/go-org v1.6.6
-	github.com/olekukonko/tablewriter v0.0.4
-	github.com/otiai10/copy v1.7.0
+	github.com/mitchellh/mapstructure v1.5.0
+	github.com/niklasfasching/go-org v1.7.0
+	github.com/olekukonko/tablewriter v0.0.5
+	github.com/otiai10/copy v1.14.0
 	github.com/pelletier/go-toml/v2 v2.2.3
-	github.com/pterm/pterm v0.12.76
+	github.com/pterm/pterm v0.12.40
 	github.com/remeh/sizedwaitgroup v1.0.0
-	github.com/smacker/go-tree-sitter v0.0.0-20240514083259-c5d1f3f5f99e
+	github.com/smacker/go-tree-sitter v0.0.0-20240827094217-dd81d9e9be82
 	github.com/spf13/pflag v1.0.5
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/tomwright/dasel/v2 v2.8.1
-	github.com/yuin/goldmark v1.5.6
-	golang.org/x/exp v0.0.0-20231006140011-7918f672742d
+	github.com/yuin/goldmark v1.7.8
+	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8
 	golang.org/x/net v0.34.0
 	golang.org/x/sys v0.29.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	atomicgo.dev/cursor v0.2.0 // indirect
-	atomicgo.dev/keyboard v0.2.9 // indirect
-	atomicgo.dev/schedule v0.1.0 // indirect
+	dario.cat/mergo v1.0.1 // indirect
+	github.com/MarvinJWendt/testza v0.4.2 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
-	github.com/andybalholm/brotli v1.0.1 // indirect
-	github.com/containerd/console v1.0.3 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/atomicgo/cursor v0.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/uuid v1.1.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/gookit/color v1.5.4 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
-	github.com/imdario/mergo v0.3.11 // indirect
-	github.com/klauspost/compress v1.11.4 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
-	github.com/lithammer/fuzzysearch v1.1.8 // indirect
-	github.com/mattn/go-runewidth v0.0.15 // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.0 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/montanaflynn/stats v0.7.1 // indirect
-	github.com/nwaples/rardecode v1.1.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
-	github.com/ulikunitz/xz v0.5.10 // indirect
-	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/crypto v0.32.0 // indirect
+	golang.org/x/sync v0.10.0 // indirect
 	golang.org/x/term v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
 	gopkg.in/neurosnap/sentences.v1 v1.0.7 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
-Original file line number
+Diff line change
@@ @@ -23,6 +23,8 @@ fixtures/formats/Sphinx/_build/ @@
     .release-env
+    .DS_Store
     # Files
     *.o
     *.a