a11655286
Denys Vlasenko
2011-01-04
Subject
tar: add a note about -C and symlink-in-tarball attack
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
archival/tar.c+19 -0
| @@ -23,6 +23,25 @@ | |
| * Licensed under GPLv2 or later, see file LICENSE in this source tree. | |
| */ | |
| + | /* TODO: security with -C DESTDIR option can be enhanced. |
| + | * Consider tar file created via: |
| + | * $ tar cvf bug.tar anything.txt |
| + | * $ ln -s /tmp symlink |
| + | * $ tar --append -f bug.tar symlink |
| + | * $ rm symlink |
| + | * $ mkdir symlink |
| + | * $ tar --append -f bug.tar symlink/evil.py |
| + | * |
| + | * This will result in an archive which contains: |
| + | * $ tar --list -f bug.tar |
| + | * anything.txt |
| + | * symlink |
| + | * symlink/evil.py |
| + | * |
| + | * Untarring it puts evil.py in '/tmp' even if the -C DESTDIR is given. |
| + | * This doesn't feel right, and IIRC GNU tar doesn't do that. |
| + | */ |
| + | |
| #include <fnmatch.h> | |
| #include "libbb.h" | |
| #include "archive.h" | |