BBOT vulnerabilities

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory. Its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder.

The vulnerability in BBOT's unarchive module fails to detect symlinks in zip and 7z archives when their listing carries a DOS-attribute prefix before the unix mode, as produced by legacy p7zip versions. This allows an attacker-controlled symlink to be written into the extraction directory when such an archive is downloaded and extracted during a scan, bypassing the guard.

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.