NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: bin/54467: new tar overwrites symlinks to directories

On Sun, Aug 18, 2019 at 03:30:01PM +0000, Christos Zoulas wrote:
>  So I guess -P does what we want and unfortunately more. I'd rather it
>  just disabled ARCHIVE_EXTRACT_SECURE_SYMLINKS... We could
>  add a long option that did exactly want we wanted I guess:
>  --security=-extract-secure-symlinks

If you allow symlinks tricks, you can just allow absolute path names
too. It really doesn't make any difference as attack vector.


Home | Main Index | Thread Index | Old Index