From 8a734f9daccbf3af8f6d305c9ae03033d4c0b52b Mon Sep 17 00:00:00 2001 From: Chris Hennick <4961925+Pr0methean@users.noreply.github.com> Date: Thu, 9 May 2024 20:01:40 -0700 Subject: [PATCH] Rephrase Signed-off-by: Chris Hennick <4961925+Pr0methean@users.noreply.github.com> --- pull_request_template.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pull_request_template.md b/pull_request_template.md index c397864f..c07ea483 100644 --- a/pull_request_template.md +++ b/pull_request_template.md @@ -2,7 +2,7 @@ We welcome your pull request, but because this crate is downloaded about 1.7 million times per month (see https://crates.io/crates/zip), and because ZIP file processing has caused security issues in the past (see https://www.cvedetails.com/vulnerability-search.php?f=1&vendor=&product=zip&cweid=&cvssscoremin=&cvssscoremax=&publishdatestart=&publishdateend=&updatedatestart=&updatedateend=&cisaaddstart=&cisaaddend=&cisaduestart=&cisadueend=&page=1 -for the gory details), we have some requirements that help ensure the crate remains trustworthy and panic-free, and we've seen +for the gory details), we have some requirements that help ensure the crate earns and keeps developers' trust, and we've seen a lot of PRs that don't meet those requirements. We don't filter out "ZIP bombs" because extreme compression ratios and shallow file copies have legitimate uses; but