Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add missing libarchive flags, some security tests #61

Merged
merged 2 commits into from May 15, 2017
Merged

Add missing libarchive flags, some security tests #61

merged 2 commits into from May 15, 2017

Conversation

ghost
Copy link

@ghost ghost commented May 14, 2017

Hi,

I've been using your library to process untrusted archives provided by the users and have noticed that two flags were missing, one of which is important when dealing with untrusted input (EXTRACT_SECURE_NOABSOLUTEPATHS).

They have been supported by libarchive for around two years so it's a stable feature that I think should be merged to your library. Take a look at man archive_write_disk.3 for details.

This pull request adds them and provides a couple of tests for two security features that are important to me at the moment.
I'll add more tests to cover the remaining flags when I have some free time.

Thanks for a great library, it saved me a lot of work.

Cheers.

--

  • Add missing flags supported by libarchive:

    • EXTRACT_SECURE_NOABSOLUTEPATHS;
    • EXTRACT_CLEAR_NOCHANGE_FFLAGS;
  • Add some tests for security options:

    • EXTRACT_SECURE_NODOTDOT;
    • EXTRACT_SECURE_NOABSOLUTEPATHS.

* Add missing flags supported by libarchive:
    - EXTRACT_SECURE_NOABSOLUTEPATHS;
    - EXTRACT_CLEAR_NOCHANGE_FFLAGS;

* Add some tests for security options:
    - EXTRACT_SECURE_NODOTDOT;
    - EXTRACT_SECURE_NOABSOLUTEPATHS.
@ghost
Copy link
Author

ghost commented May 14, 2017

Hmm, it seems that one of the flags was added in libarchive v.3.1.900, while Travis CI build uses 3.1.2, which was released two years before that. I'll try to work around it by checking which version of the library we are using, if at all possible.

@Changaco
Copy link
Owner

Looks okay to me.

@Changaco Changaco merged commit 36fd926 into Changaco:master May 15, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant