Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

We should avoid huge file tree path structure #4

Open
ziadhany opened this issue Jan 14, 2025 · 0 comments
Open

We should avoid huge file tree path structure #4

ziadhany opened this issue Jan 14, 2025 · 0 comments

Comments

@ziadhany
Copy link
Collaborator

file structure Look like this: aboutcode-org/federatedcode#3

vulnerablecode-data/aboutcode-vulnerabilities/1a/VCID-1aqn-grcz-ykgu.yml
vulnerablecode-data/aaboutcode-packages-alpine-0/alpine/apr/VCID-g3j9-zdd6-aaad.yaml
vulnerablecode-data/aaboutcode-packages-alpine-0/alpine/apr/alpine-advancecomp.yaml

Currently, the repository size is less than 300MB as it is just a sample. However, we plan to store millions of files in the future.

GitHub Team's Response to the Bug in Pull Request #3:

you are noticing is due to the huge file tree path in PR which affects only that specific PR and as such it does not present a denial of service vulnerability.

For this, we would recommend you distribute the directories into no more that a few thousand files/subdirectories in a given directory to avoid scenarios like such.

I will share the entire report with you from GitHub after the disclosure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant