f5e1bf966
Denys Vlasenko
2025-09-24
Subject
archival/libarchive: sanitize filenames on output (prevent control sequence attacks
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
archival/libarchive/header_list.c+1 -1
| @@ -8,5 +8,5 @@ | |
| void FAST_FUNC header_list(const file_header_t *file_header) | |
| { | |
| //TODO: cpio -vp DIR should output "DIR/NAME", not just "NAME" */ | |
| - | puts(file_header->name); |
| + | puts(printable_string(file_header->name)); |
| } | |
archival/libarchive/header_verbose_list.c+2 -2
| @@ -57,13 +57,13 @@ void FAST_FUNC header_verbose_list(const file_header_t *file_header) | |
| ptm->tm_hour, | |
| ptm->tm_min, | |
| ptm->tm_sec, | |
| - | file_header->name); |
| + | printable_string(file_header->name)); |
| #endif /* FEATURE_TAR_UNAME_GNAME */ | |
| /* NB: GNU tar shows "->" for symlinks and "link to" for hardlinks */ | |
| if (file_header->link_target) { | |
| - | printf(" -> %s", file_header->link_target); |
| + | printf(" -> %s", printable_string(file_header->link_target)); |
| } | |
| bb_putchar('\n'); | |
| } | |