"safe links" behavior can be circumvented by bad files

stephenseo commented

2024-10-21 08:43:27 +00:00

Owner

If a symlink exists in an archive that doesn't point to anything in the archive, and the bit marking it as invalid is not set, it may still be created on extraction. To fix this, a check will be needed to avoid creating such a link unless if "--no-safe-links" is specified.

stephenseo added the

Kind/Security

label 2024-10-21 08:43:27 +00:00

stephenseo self-assigned this 2024-10-21 08:43:27 +00:00

stephenseo added this to the Development Planning project 2024-10-21 08:43:27 +00:00

stephenseo commented

2024-10-22 04:48:21 +00:00

Author

Owner

Due to both version 0 and 1 of the file format, all files will need to be extracted first before checking if the link actually points to one of them. This means that the workflow for checking this probably will be as follows: extract everything while keeping track of filenames, check every created symlink if it points to the previously extracted files (and proper symlink to symlink handling), and removal of bad symlinks.

This has to be done this way because seeking the input file will break compatibility with piped in archives, and the only way to check against all files in the archive is to extract them first. In other words, seeking is not allowed and has to be done in a single pass through the input file and extraction must take place to get every filename.

Due to both version 0 and 1 of the file format, all files will need to be extracted first before checking if the link actually points to one of them. This means that the workflow for checking this probably will be as follows: extract everything while keeping track of filenames, check every created symlink if it points to the previously extracted files (and proper symlink to symlink handling), and removal of bad symlinks. This has to be done this way because seeking the input file will break compatibility with piped in archives, and the only way to check against all files in the archive is to extract them first. In other words, seeking is not allowed and has to be done in a single pass through the input file and extraction must take place to get every filename.

stephenseo referenced this issue from a commit

2024-10-24 04:42:11 +00:00

Safe-links enforce on extract, fixes/refactorings

stephenseo closed this issue

2024-10-28 04:47:21 +00:00

"safe links" behavior can be circumvented by bad files #20