Skip to content

Comments

fix: do not create directories outside#24

Merged
dignifiedquire merged 2 commits intomasterfrom
fix-outside-dir
Aug 24, 2021
Merged

fix: do not create directories outside#24
dignifiedquire merged 2 commits intomasterfrom
fix-outside-dir

Conversation

@dignifiedquire
Copy link
Owner

ports alexcrichton/tar-rs#259

Closes #23

TODO: fix now failing test

@dignifiedquire dignifiedquire merged commit 9e61431 into master Aug 24, 2021
@dignifiedquire dignifiedquire deleted the fix-outside-dir branch August 24, 2021 08:55
charliermarsh added a commit to astral-sh/tokio-tar that referenced this pull request Feb 2, 2025
## Summary

This is a port of alexcrichton/tar-rs#259 which was later ported to `async-tar` in dignifiedquire/async-tar#24. The goal is to avoid allowing archives to create directories outside of the target path by deferring the creation of directories.

## Test Plan

`cargo test`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

async-tar may be exposed to RUSTSEC-2021-0080: Links in archive can create arbitrary directories

1 participant