[Bug 10651] tar: check for unsafe symlinks is overly strict

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=10651

--- Comment #6 from Harald van Dijk <bb at gigawatt.nl> ---
(In reply to Denys Vlasenko from comment #4)
> Propose something better, or how to tweak this solution to be more usable.

I did have two concrete proposals for something better in my initial comment:

1: Keep the current check, but modify it to allow all symlinks to files to be
extracted.

OR:

2: Remove the current check, allow all symlinks to be extracted, but add a
check that requires all path components during extraction to be real
directories, not symlinks.

Option 1 should be trivial to implement, no less safe than the current
implementation, and sufficient for the use cases mentioned in this report.

Option 2 is difficult to implement, but potentially safer since it also
protects against symlinks created without the use of tar. An added benefit is
that it would never error out when simply creating an archive from directory A
and extracting it into directory B, regardless of what symlinks A might
contain, so it would have fewer false positives.

(In reply to Denys Vlasenko from comment #5)
> Will it help if EXTRACT_UNSAFE_SYMLINKS can be configurable at build time?

Perhaps, but like I wrote earlier, I do like the idea of this check, so I would
prefer to tweak the logic so that it works for more cases.

-- 
You are receiving this mail because:
You are on the CC list for the bug.