Skip to content

Allow .. links in secure extract in parent path - #48

Merged
bingos merged 1 commit into
jib:masterfrom
stigtsp:secure-extract-contain-to-parent-path
Jun 2, 2026
Merged

bingos merged 1 commit into
jib:masterfrom
stigtsp:secure-extract-contain-to-parent-path

Conversation

@stigtsp

@stigtsp stigtsp commented Jun 2, 2026 •

Copy link
Copy Markdown
Contributor

Checks that link targets are in the parent patch using _symlinks_resolver with an added strict flag.

This caused issues extracting a git archive from perl5, as described on #p5p:

15:07 <tib> BinGOs It's probably expected but the new Archive::Tar ("refuse symlinks to relative with ..") starting at 3.08 refuses even a git archive from our venerable perl5 repo (git archive HEAD | gzip > source.tar.gz) then perl extract.pl (my $tar = Archive::Tar->new; $tar->read('../source.tar.gz', 1); $tar->extract();) gives Symlink

Assisted-by: OpenAI Codex

Assisted-by: OpenAI Codex
Signed-off-by: Stig Palmquist <git@stig.io>
@stigtsp
stigtsp force-pushed the secure-extract-contain-to-parent-path branch from a58523e to 77e0d98 Compare June 2, 2026 14:17
@bingos
bingos merged commit 484f71e into jib:master Jun 2, 2026
6 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants