mirrors/kitty
1
0
Fork 0
mirror of https://github.com/kovidgoyal/kitty synced 2026-07-19 06:54:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

skip illegal paths in tar archives rather than erroring on them

Browse Source
This commit is contained in:
Kovid Goyal
2025-04-20 23:12:17 +05:30
parent d7f4d44d8e
commit 5a6c2d9f3b
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tools/utils/tar.go
View File

@@ -68,7 +68,7 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
}
}
if !strings.HasPrefix(filepath.Clean(dest), filepath.Clean(dest_path)+string(os.PathSeparator)) {
return count, fmt.Errorf("illegal path in tar archive: %s", hdr.Name)
continue
}
switch hdr.Typeflag {
case tar.TypeDir:
@@ -99,7 +99,15 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
if err = os.MkdirAll(filepath.Dir(dest), 0o700); err != nil {
return
}
if err = os.Link(hdr.Linkname, dest); err != nil {
link_target := hdr.Linkname
if !filepath.IsAbs(link_target) {
link_target = filepath.Join(filepath.Dir(dest), link_target)
}
// Ensure the symlink target is within the destination directory
if !strings.HasPrefix(filepath.Clean(link_target), filepath.Clean(dest_path)+string(os.PathSeparator)) {
continue
}
if err = os.Link(link_target, dest); err != nil {
return
}
if err = set_metadata(func(m fs.FileMode) error { return os.Chmod(dest, m) }, hdr); err != nil {
@@ -115,7 +123,7 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
}
// Ensure the symlink target is within the destination directory
if !strings.HasPrefix(filepath.Clean(link_target), filepath.Clean(dest_path)+string(os.PathSeparator)) {
return count, fmt.Errorf("illegal symlink target: %s -> %s", hdr.Name, link_target)
continue
}
if err = os.Symlink(link_target, dest); err != nil {
return