A modified version of my pax-mods proposal:

It was noted to me offlist that perhaps checking all in-filesystem symlinks
would be useful after all.  So, I've nixed the symlink name cache below and
gone to uniform lstat(2)-walking.

=====

1. Create a "safe mode" flag in pax, which will make all of the following
   an error rather than a warning.  Use this flag in e.g. pkg_add(8).

2. For each entry being extracted, warn if any intervening path component is
   a symlink in the filesystem.  (This catches both extant symlinks *and*
   those created by pax.)

   If the entry's full path is an extant symlink, however, don't warn; do
   standard unlink-and-create logic.  (This would have to be tested as to
   whether it DTRT for non-plain-files, e.g. directories and device nodes,
   that replace symlinks in the filesystem.  The idea is that even a
   directory that exactly matches an extant symlink would simply replace the
   symlink with a directory safely.)

3. If a file is encountered in the archive which contains "../" in its
   pathname, warn (without regard to whether the path appears to stay within
   the archive; this is a corner case and difficult to get "right" in the
   face of possible symlink warnings, above).

=====

The above keeps the warnings more uniform and easier to understand/explain.
It's unusual for symlinks to sit in the middle of an extracted entry's path,
so it probably is a good idea to warn about them all around.

Since (2) would involve some significant lstat(2) load, it would probably be
a good idea either to cache results with hsearch(3) or similar.  Note that
if these results are cached, they need to be obliterated if a later entry in
the archive unlinks the symlink in question.

-- 
-- Todd Vierling <tv@pobox.com>