From ad33de863d8bc89fdcb0cfc338d276725cdd2103 Mon Sep 17 00:00:00 2001 From: Chris Markiewicz Date: Mon, 19 Aug 2024 16:33:29 -0400 Subject: [PATCH] feat(schema): Split gzip warnings --- src/schema/rules/checks/privacy.yaml | 32 ++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/src/schema/rules/checks/privacy.yaml b/src/schema/rules/checks/privacy.yaml index c9e2ecf0cb..f21f25b167 100644 --- a/src/schema/rules/checks/privacy.yaml +++ b/src/schema/rules/checks/privacy.yaml @@ -1,17 +1,41 @@ --- -GzipHeaderFields: +GzipHeaderMtime: issue: - code: GZIP_HEADER_DATA + code: GZIP_HEADER_MTIME message: | - The gzip header contains a non-zero timestamp or a non-empty filename and/or comment field. - These may leak sensitive information or indicate a non-reproducible conversion process. + The gzip header contains a non-zero timestamp. + This may leak sensitive information or indicate a non-reproducible conversion process. level: warning selectors: - match(extension, ".gz$") - gzip != null checks: - gzip.timestamp == 0 + +GzipHeaderFilename: + issue: + code: GZIP_HEADER_FILENAME + message: | + The gzip header contains a non-empty filename. + This may leak sensitive information or indicate a non-reproducible conversion process. + level: warning + selectors: + - match(extension, ".gz$") + - gzip.filename + checks: - gzip.filename == "" + +GzipHeaderComment: + issue: + code: GZIP_HEADER_COMMENT + message: | + The gzip header contains a non-empty comment field. + This may leak sensitive information or indicate a non-reproducible conversion process. + level: warning + selectors: + - match(extension, ".gz$") + - gzip.comment + checks: - gzip.comment == "" CheckAge89: