mirrors/tar
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

When extracting, skip ".." members

Browse Source 
* NEWS: Document this.
* src/extract.c (extract_archive): Skip members whose names
contain "..".
This commit is contained in:
Paul Eggert
2016-10-29 21:04:40 -07:00
committed by Paul Eggert
parent 1d2674bacc
commit 7340f67b98
2 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
NEWS
View File

@@ -1,9 +1,15 @@
GNU tar NEWS - User visible changes. 2016-05-27 GNU tar NEWS - User visible changes. 2016-10-29
Please send GNU tar bug reports to <bug-tar@gnu.org> Please send GNU tar bug reports to <bug-tar@gnu.org>
version 1.29.90 (Git) version 1.29.90 (Git)
* Member names containing '..' components are now skipped when extracting.
This fixes tar's behavior to match its documentation, and is a bit
safer when extracting untrusted archives over old files (an unsafe
practice that the tar manual has long recommended against).
* Report erroneous use of positional options. * Report erroneous use of positional options.
During archive creation or update, tar keeps track of positional During archive creation or update, tar keeps track of positional

8
src/extract.c
View File

@@ -1629,12 +1629,20 @@ extract_archive (void)
{ {
char typeflag; char typeflag;
tar_extractor_t fun; tar_extractor_t fun;
bool skip_dotdot_name;
fatal_exit_hook = extract_finish; fatal_exit_hook = extract_finish;
set_next_block_after (current_header); set_next_block_after (current_header);
skip_dotdot_name = (!absolute_names_option
&& contains_dot_dot (current_stat_info.orig_file_name));
if (skip_dotdot_name)
ERROR ((0, 0, _("%s: Member name contains '..'"),
quotearg_colon (current_stat_info.orig_file_name)));
if (!current_stat_info.file_name[0] if (!current_stat_info.file_name[0]
|| skip_dotdot_name
|| (interactive_option || (interactive_option
&& !confirm ("extract", current_stat_info.file_name))) && !confirm ("extract", current_stat_info.file_name)))
{ {