CERBERUS/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty.git synced 2026-10-21 04:32:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

skip illegal paths in tar archives rather than erroring on them

Browse source
This commit is contained in:
Kovid Goyal 2025-04-20 23:12:17 +05:30
parent d7f4d44d8e
commit 5a6c2d9f3b
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
1 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tools/utils/tar.go
View file

@ -68,7 +68,7 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
}
}
if !strings.HasPrefix(filepath.Clean(dest), filepath.Clean(dest_path)+string(os.PathSeparator)) {
return count, fmt.Errorf("illegal path in tar archive: %s", hdr.Name)
continue
}
switch hdr.Typeflag {
case tar.TypeDir:
@ -99,7 +99,15 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
if err = os.MkdirAll(filepath.Dir(dest), 0o700); err != nil {
return
}
if err = os.Link(hdr.Linkname, dest); err != nil {
link_target := hdr.Linkname
if !filepath.IsAbs(link_target) {
link_target = filepath.Join(filepath.Dir(dest), link_target)
}
// Ensure the symlink target is within the destination directory
if !strings.HasPrefix(filepath.Clean(link_target), filepath.Clean(dest_path)+string(os.PathSeparator)) {
continue
}
if err = os.Link(link_target, dest); err != nil {
return
}
if err = set_metadata(func(m fs.FileMode) error { return os.Chmod(dest, m) }, hdr); err != nil {
@ -115,7 +123,7 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
}
// Ensure the symlink target is within the destination directory
if !strings.HasPrefix(filepath.Clean(link_target), filepath.Clean(dest_path)+string(os.PathSeparator)) {
return count, fmt.Errorf("illegal symlink target: %s -> %s", hdr.Name, link_target)
continue
}
if err = os.Symlink(link_target, dest); err != nil {
return