Re: bin/54467: new tar overwrites symlinks to directories

[Joerg Sonnenberger <joerg%bec.de@localhost>]

On Sun, Aug 18, 2019 at 03:30:01PM +0000, Christos Zoulas wrote:
>  So I guess -P does what we want and unfortunately more. I'd rather it
>  just disabled ARCHIVE_EXTRACT_SECURE_SYMLINKS... We could
>  add a long option that did exactly want we wanted I guess:
>  --security=-extract-secure-symlinks

If you allow symlinks tricks, you can just allow absolute path names
too. It really doesn't make any difference as attack vector.

Joerg