Visrustotal false positives detected in user-created ZIP file of source code (!)

[calipito777]

[HebaruSan]

Hi @calipito777, you submitted a file called CKAN-1.36.2.zip to that tool:

This is not a file created or distributed by us; we distribute ckan.exe standalone or packaged in .rpm, .deb, or .dmg files. You must have made this ZIP file yourself.

The "threats" that it reported are all related to the ZIP archive format:

Whatever they're detecting, it's related to the ZIP file that you made, not CKAN.

[calipito777]

the zip I made is the source code of ckan, downloaded in this page https://github.com/KSP-CKAN/CKAN/releases

[HebaruSan]

Oh. That's even more useless; the source code isn't what runs on your PC. Don't waste your time with that.

[HebaruSan]

Depending on how dumb that detector is, if it's looking at the source code, it might be detecting the fact that CKAN has a test to make sure it is not vulnerable to ZIP bombs, just in case a malicious ZIP file ever makes it into the KSP modding ecosystem:

CKAN/Tests/Core/IO/ModuleInstallerTests.cs

Lines 1063 to 1095 in 07b29fb

	[Test]
	[Explicit("Slow corner case in rarely touched code")]
	public void InstallList_RealZipBomb_DoesNotThrow()
	{
	// Arrange
	using (var repo = new TemporaryRepository(TestData.DogeCoinFlag_101ZipBomb()))
	using (var repoData = new TemporaryRepositoryData(nullUser, repo.repo))
	using (var inst = new DisposableKSP())
	using (var config = new FakeConfiguration(inst.KSP, inst.KSP.Name))
	using (var manager = new GameInstanceManager(nullUser, config))
	using (var regMgr = RegistryManager.Instance(inst.KSP, repoData.Manager,
	new Repository[] { repo.repo }))
	{
	manager.SetCurrentInstance(inst.KSP);
	var registry = regMgr.registry;
	// Copy the zip file to the cache directory.
	manager.Cache?.Store(TestData.DogeCoinFlag_101ZipBomb_module(),
	TestData.DogeCoinFlagZipBombZip(),
	null);
	// Attempt to install it.
	var modules = new List<CkanModule> { TestData.DogeCoinFlag_101ZipBomb_module() };
	// Act / Assert
	HashSet<string>? possibleConfigOnlyDirs = null;
	new ModuleInstaller(inst.KSP, manager.Cache!, config, nullUser)
	.InstallList(modules,
	new RelationshipResolverOptions(inst.KSP.StabilityToleranceConfig),
	regMgr, ref possibleConfigOnlyDirs);
	}
	}

2d29d21

This code is part of the test suite, which is not included in the ckan.exe that is distributed to users.
Currently the [Explicit] attribute means that it is disabled because it takes a long time to run and it's unlikely to break, but we can run it by name as needed any time we change something ZIP-related.