2.8.6 Release

[liquidsec]

Summary

• Fix arbitrary file write in postman_download via path traversal (sanitize workspace/collection names with tagify() + is_relative_to() guard)
• Defense-in-depth hardening for gitdumper and git_clone (safe git flags, path traversal check in download_files, empty index on checkout failure for CVE-2025-10283)
• Defense-in-depth hardening for apkpure (reject app_id containing /, \, or ..)
• Restrict pickle.load in preload cache to block arbitrary class instantiation
• Cap unarchive extracted size at 1 GB with pre-extraction declared-size check and cumulative budget through recursive calls to prevent decompression bomb DoS
• Bump version to 2.8.6

[github-actions]

📊 Performance Benchmark Report

Comparing stable (baseline) vs security-patches-jun-26-2 (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	4.26ms	4.24ms	-0.4% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	18.07ms	17.84ms	-1.3% ⚪	✅
Large Closest Match Lookup	358.72ms	351.78ms	-1.9% ⚪	✅
Realistic Closest Match Workload	191.48ms	188.76ms	-1.4% ⚪	✅
Event Validation Full Scan Startup Small Batch	488.35ms	497.23ms	+1.8% ⚪	✅
Event Validation Full Scan Startup Large Batch	839.61ms	840.31ms	+0.1% ⚪	✅
Make Event Autodetection Small	31.62ms	31.27ms	-1.1% ⚪	✅
Make Event Autodetection Large	320.44ms	320.29ms	-0.0% ⚪	✅
Make Event Explicit Types	14.11ms	14.05ms	-0.5% ⚪	✅
Excavate Single Thread Small	4.150s	4.109s	-1.0% ⚪	✅
Excavate Single Thread Large	9.876s	9.899s	+0.2% ⚪	✅
Excavate Parallel Tasks Small	4.257s	4.250s	-0.2% ⚪	✅
Excavate Parallel Tasks Large	7.400s	7.391s	-0.1% ⚪	✅
Is Ip Performance	3.21ms	3.30ms	+2.7% ⚪	✅
Make Ip Type Performance	11.71ms	11.66ms	-0.4% ⚪	✅
Mixed Ip Operations	4.57ms	4.67ms	+2.2% ⚪	✅
Typical Queue Shuffle	62.65µs	63.01µs	+0.6% ⚪	✅
Priority Queue Shuffle	695.18µs	705.71µs	+1.5% ⚪	✅

🎯 Performance Summary

✅ No significant performance changes detected (all changes <10%)

---

🐍 Python Version 3.11.15

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 92%. Comparing base (cb923f5) to head (2d8e2a6).

Files with missing lines	Patch %	Lines
bbot/modules/internal/unarchive.py	75%	8 Missing ⚠️
bbot/modules/gitdumper.py	82%	3 Missing ⚠️
bbot/modules/apkpure.py	34%	2 Missing ⚠️
bbot/modules/postman_download.py	75%	2 Missing ⚠️
bbot/core/modules.py	75%	1 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##           stable   #3199   +/-   ##
======================================
- Coverage      92%     92%   -0%     
======================================
  Files         408     408           
  Lines       34727   34802   +75     
======================================
+ Hits        31658   31715   +57     
- Misses       3069    3087   +18     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.