Re busybox tar hidden filename exploit

[Kang-Che Sung]

From: Ian Norton
>
> I had a brief look at if I could submit a patch, but I'm very very new to
the busybox codebase.  It appears that the same functions used to print the
filenames to stdout are also shared by a number of other busybox modules.
I _think_ that the cpio tool has the same flaw.
>
> Something that would escape any non-ascii would have been my first
instinct too though perhaps that would not work so well on non 8-bit
charsets.

From: Walter Harms
>
> What does gnutar do here  ?
>

Hey. Did you guys read this section in GNN find manual?

"Safe File Name Handling"
https://www.gnu.org/software/findutils/manual/html_node/find_html/Safe-File-Name-Handling.html

When it comes to unusual filenames, the GNU way of doing it is implementing
a `--null` option that accepts the list of filenames separated by ASCII NUL
characters.

Various other utilities can print the filename list with NUL as the
separator. For example `-print0` command in `find(1)`.

These are how GNU utilities handle unusual filenames.

It might not sound like a good idea to implement something that escape
filenames during output (such as GNU ls(1) `--quoting-style` option),
because a lot of utilities would need it, and I believe it's not the Unix
way of doing things. Filename quoting and escaping should ideally be it's
own utility (the closest I could find is `od -c`, although it's not in the
quoting style people are familiar with).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/busybox/attachments/20240703/fa2ddcd6/attachment.html>