cs: Query for ZipSlip vulnerability (CVE-2018-1002200)

[denislevin]

Initial check in to validate the tests

[ghost]

All committers have signed the CLA.

[calumgrant]

I have created a pull request against your branch to fix the failing unit tests.
denislevin#1

[calumgrant]

Good stuff! We can merge this once you have removed the @precision tag and the tests pass. @lukecartey has some further work on this and we can add qhelp as well.

[denislevin]

Removed @precision tag, merged unit test fixes from #1 branch

[lcartey]

Thanks @denislevin. This is ready to merge apart from the CLA, which was updated this morning, so unfortunately you'll need to sign it again - sorry about that!

[denislevin]

Luke, Is there any way to get the diff of new CLA and old CLA? I can’t find it in GitHub. Thanks! -Denis From: Luke Cartey <notifications@github.com> Sent: Wednesday, August 15, 2018 7:42 AM To: Semmle/ql <ql@noreply.github.com> Cc: Denis Levin <denisl@microsoft.com>; Mention <mention@noreply.github.com> Subject: Re: [Semmle/ql] cs: Query for ZipSlip vulnerability (CVE-2018-1002200) (#54) Thanks @denislevin<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fdenislevin&data=02%7C01%7Cdenisl%40microsoft.com%7Cc9af1c94aa754b64bbe108d602bd457e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636699409272843125&sdata=o9wubixJO1BYe0CmDaXv89Res5qlftsdfIVavmHV2VM%3D&reserved=0>. This is ready to merge apart from the CLA, which was updated this morning, so unfortunately you'll need to sign it again - sorry about that! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FSemmle%2Fql%2Fpull%2F54%23issuecomment-413219228&data=02%7C01%7Cdenisl%40microsoft.com%7Cc9af1c94aa754b64bbe108d602bd457e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636699409272843125&sdata=Gfakufk%2BrRUY%2Bnf2qmpqFaY%2B8eRsOECffepyTMMir7U%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAoZZuCtW5P_UMD73CmPDIB2lxh5osfijks5uRDM9gaJpZM4V7d-m&data=02%7C01%7Cdenisl%40microsoft.com%7Cc9af1c94aa754b64bbe108d602bd457e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636699409272853130&sdata=8hrKYkFbelUDy2M2XFthP7cdFo0fhJmPw800fVGaN4M%3D&reserved=0>.

[lcartey]

@denislevin Sorry, I should have mentioned what changed. We've updated the formatting, and corrected our company name. You can see a full diff of the changes here:

https://gist.github.com/semmle-cla/577697e169c751bae58e29998f86a4f6/revisions

The CLA document is also available in the repository here:

https://github.com/Semmle/ql/blob/master/CONTRIBUTING.md