Skip to content

Commit

Permalink
doc: More concise re trust
Browse files Browse the repository at this point in the history
Signed-off-by: Chris Hennick <[email protected]>
  • Loading branch information
Pr0methean authored May 10, 2024
1 parent 9501817 commit c8a68fa
Showing 1 changed file with 2 additions and 5 deletions.
7 changes: 2 additions & 5 deletions pull_request_template.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,8 @@
We welcome your pull request, but because this crate is downloaded about 1.7 million times per month (see https://crates.io/crates/zip),
and because ZIP file processing has caused security issues in the past (see
https://www.cvedetails.com/vulnerability-search.php?f=1&vendor=&product=zip&cweid=&cvssscoremin=&cvssscoremax=&publishdatestart=&publishdateend=&updatedatestart=&updatedateend=&cisaaddstart=&cisaaddend=&cisaduestart=&cisadueend=&page=1
for the gory details), we have some requirements that help ensure we continuously earn developers' and their clients'
trust. I (@Pr0methean) am an Amazonian, and although I maintain this crate in a personal capacity (except when fellow Amazonians
express new requirements), I still strive to uphold Amazon's Leadership Principles, especially "Earn Trust" (see
https://www.amazon.jobs/content/en/our-workplace/leadership-principles). But I've received a lot of PRs that didn't initially meet
the requirements I derived from that LP.
for the gory details), we have some requirements that help ensure we maintain developers' and their clients' trust.
This implies some requirements that a lot of PRs don't initially meet.
This crate doesn't filter out "ZIP bombs" because extreme compression ratios and shallow file copies have legitimate uses; but
I expect the tools the crate provides for checking that extraction is safe, such as the `ZipArchive::decompressed_size` method in
Expand Down

0 comments on commit c8a68fa

Please sign in to comment.