Skip to content
This repository was archived by the owner on Oct 12, 2022. It is now read-only.
This repository was archived by the owner on Oct 12, 2022. It is now read-only.

Google Play Console reports security error: Zip Path Traversal Error due to cordova-plugin-zip dependency #671

Description

Description

Google Play Console reports security error in Pre-launch report details.

Pre-launch report details

Security and trust

Zip Path Traversal

Your app contains an unsafe unzipping pattern that may lead to a Path Traversal vulnerability. Please see this Google Help Center article to learn how to fix the issue.

  • org.apache.cordova.Zip.unzipSync

image

The reported error is being caused by cordova plugin cordova-plugin-zip which is a dependency of cordova-plugin-code-push

Reproduction

Install cordova-plugin-code-push, build production APK and submit it to Google Play Console.

Additional Information

  • cordova-plugin-code-push version: 2.0.0
  • Cordova version: 10.0.0

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions