diff options
| author | emaste <emaste@FreeBSD.org> | 2015-04-09 13:45:17 +0000 |
|---|---|---|
| committer | emaste <emaste@FreeBSD.org> | 2015-04-09 13:45:17 +0000 |
| commit | c4c8403c3f4700c606b6ceb7a8c3e4f067d9e5c3 (patch) | |
| tree | 424a30dca65ec792e35d8669b75371e2b631b17b /usr.bin/ar/read.c | |
| parent | 2e38078077c5e0f74c769cb66f0ecaa931f8186e (diff) | |
| download | FreeBSD-src-c4c8403c3f4700c606b6ceb7a8c3e4f067d9e5c3.zip FreeBSD-src-c4c8403c3f4700c606b6ceb7a8c3e4f067d9e5c3.tar.gz | |
ar: Disallow directory traversal
Set ARCHIVE_EXTRACT_SECURE_SYMLINKS and ARCHIVE_EXTRACT_SECURE_NODOTDOT
as in bsdtar to prevent extraction of archive entries whose pathnames
contain .. or whose target directory would be altered by a symlink.
Also disallow absolute pathnames.
We don't currently provide an option to disable this behaviour (as
bsdtar's -P does). It is unlikely to be a problem in practice for ar(1),
but the -P option is not currently used and available if we want to
consider it for this purpose.
Differential Revision: https://reviews.freebsd.org/D1524
Reported by: Alexander Cherepanov <cherepan@mccme.ru>
Approved by: delphij
Obtained from: ELF tool chain ar, Ticket #474
MFC after: 1 week
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'usr.bin/ar/read.c')
| -rw-r--r-- | usr.bin/ar/read.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/usr.bin/ar/read.c b/usr.bin/ar/read.c index ed7a94a..aa499e0 100644 --- a/usr.bin/ar/read.c +++ b/usr.bin/ar/read.c @@ -187,7 +187,15 @@ read_archive(struct bsdar *bsdar, char mode) if (bsdar->options & AR_V) (void)fprintf(stdout, "x - %s\n", name); - flags = 0; + /* Disallow absolute paths. */ + if (name[0] == '/') { + bsdar_warnc(bsdar, 0, + "Absolute path '%s'", name); + continue; + } + /* Basic path security flags. */ + flags = ARCHIVE_EXTRACT_SECURE_SYMLINKS | \ + ARCHIVE_EXTRACT_SECURE_NODOTDOT; if (bsdar->options & AR_O) flags |= ARCHIVE_EXTRACT_TIME; |
