mirror of
https://git.savannah.gnu.org/git/tar.git
synced 2026-07-19 14:32:22 +00:00
Sergey Poznyakoff
145a671e8a
Extraction over symlink to a directory was broken in 75b03fdff4.
See https://savannah.gnu.org/bugs/index.php?68368
* src/tar.c (decode_options): Don't enable RESOLVE_BENEATH mode
if --dereference is given.
* tests/extrac33.at: New test.
* tests/Makefile.am: Add new test.
* tests/testsuite.at: Likewise.
* tests/extrac13.at: Add a keyword.
* tests/extrac31.at: Remove --absolute-names keyword: that option
is never used in the testcase. Add CVE-2025-45582 keyword instead.
54 lines
1.8 KiB
Plaintext
54 lines
1.8 KiB
Plaintext
# Test suite for GNU tar. -*- Autotest -*-
|
|
# Copyright 2026 Free Software Foundation, Inc.
|
|
#
|
|
# This file is part of GNU tar.
|
|
#
|
|
# GNU tar is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# GNU tar is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
# Description: Fixing CVE-2025-45582 (commit 75b03fdff4) broke some
|
|
# legitimate cases of extracting over symlinks with the --dereference
|
|
# option. Check if that is fixed.
|
|
#
|
|
# References: https://savannah.gnu.org/bugs/index.php?68368
|
|
|
|
AT_SETUP([extract over symlink to dir with --dereference])
|
|
AT_KEYWORDS([extract extrac33 CVE-2025-45582 --dereference])
|
|
AT_DATA([archive.in],
|
|
[/Td6WFoAAATm1rRGAgAhARYAAAB0L+Wj4Cf/AJxdABcLvBx9AZXAHUpGnBzE/y67neFgHitlwSWw
|
|
/oOsdf1GACIE/0RnS0Lp6Mj1RyfaFcxOxcWz61KEu+VeJMMAUhYEcMyGrz191zPA4rOoVcIqYEm0
|
|
B9Jiq66xT/4F6gUOeitk5fqE+uMdHKK7QTaty/dnoxtba+McJh/dXP2TUStl0xetvrnvCE1/2tKZ
|
|
grqe/9/HpysFqZnu5sskAABO7ZNxp1eWNgABuAGAUAAA/vRJibHEZ/sCAAAAAARZWg==
|
|
])
|
|
AT_CHECK([base64 --help >/dev/null 2>&1 || AT_SKIP_TEST
|
|
xz --help >/dev/null 2>&1 || AT_SKIP_TEST
|
|
base64 -d < archive.in | xz -c -d > archive.tar
|
|
])
|
|
AT_CHECK([mkdir dir dir2 hdir
|
|
cd dir
|
|
ln -sf ../dir2 .
|
|
cd ../hdir
|
|
ln -sf ../dir2 .
|
|
])
|
|
AT_CHECK([tar -C dir -xf archive.tar || exit 1
|
|
test -d dir/dir2
|
|
])
|
|
AT_CHECK([tar -C hdir -hxf archive.tar || exit 1
|
|
test -h hdir/dir2 || exit 2
|
|
ls dir2
|
|
],
|
|
[0],
|
|
[file2
|
|
])
|
|
AT_CLEANUP
|