13 lines
614 B
Markdown
13 lines
614 B
Markdown
# Security
|
|
|
|
Report vulnerabilities privately through the repository owner on the Gitea
|
|
instance. Do not attach confidential packages to a public issue.
|
|
|
|
Package Tools processes untrusted archives locally. Its main controls are
|
|
source/entry/count/expansion limits, strict CRC and overlap checks before
|
|
extracting a selected entry, path normalization and collision diagnostics,
|
|
DTD/entity rejection, bounded JSON parsing, no script execution, and no remote
|
|
reference resolution. A browser or dependency decoder vulnerability remains
|
|
outside the guarantees of the application; keep dependencies and browsers
|
|
current.
|