Skip to content

Conversation

@remicollet
Copy link
Member

@remicollet remicollet commented Nov 21, 2023

compute file index once to avoid multiple searches
constify file name

compute file index once to avoid multiple searches
constify file name
@remicollet
Copy link
Member Author

remicollet commented Nov 21, 2023

Notice: I consider this as a behavior change so only to apply in 8.4+ (and zip extension 1.23.0)
rather than a bugfix (8.3+ and 1.22.4)

Need to check if restoring perm may raise security issues

  • creating an executable from an untrusted archive
  • extracting directory with 000 permissons (so its removal will fail)

@remicollet
Copy link
Member Author

Too problematic
Also easy to do in user space using example in
https://www.php.net/manual/en/ziparchive.getexternalattributesindex.php

@remicollet remicollet closed this Nov 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant