microsoft / microsoft/component-detection
Component paths being duplicated and containing "/.." in detected components
@cobya is already working on this.
Since Nov 30, 2023.
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
We noticed in some pipelines running CG that the Component Detection task was sending us weird paths for components that contained /../../.. either in the start of the path or in the middle, when the paths did not actually contain the "/.." in the repositories.
These paths were also duplicates of other paths detected for the component, with the only difference being the additional "/.." in the path.
For example:
```
--- Component: ---
github.com/ghodss/yaml v1.0.0 - Go
--- Found at: ---
/s/src/1/2/3
/../../../../someotherpath
/../../../../s/src/1/2/3
/someotherpath
```
AB#2109910
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.