AlDanial/cloc v2.12

v2.12 -- Security Update

on GitHub

This is a security release to address vulnerabilities in the handling of archive files (zip, tar, rpm, whl, gem, etc). A maliciously crafted archive file counted with cloc versions before this release can allow a remote code execution (RCE) attack.

All users are encouraged to update to this (or newer, when available) version.

New Languages and File Types:

• AL (Business Central)
• CUE
• KDL
• RON
• Salam
• Sema
• Windows INF
• Wren

Updates:

• Add ability to count contents of .gem files.
• New switch --total to show total column counts
• Make --exclude-lang case insensitive to make it consistent with --include-lang
• Recognize comment markers in single quoted QML strings
• Add .scp as an extension for SQL stored procedures
• Add .inc as an extension for Assembly

Bug fixes:

• Secure handling of system calls to expand archive files.
• Prevent regex timeouts in Swift.
• Lower memory requirements when handling large XML/HTML and binary files.
• Fix double-open on Windows when handling long paths.
• Ensure an archive file is not a directory before attempting to extract it.