[jira] [Commented] (COMPRESS-603) Expander does not support archives with archive entries beginning with ./

[Peter Lee (Jira)]

    [ 
https://issues.apache.org/jira/browse/COMPRESS-603?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17489299#comment-17489299
 ] 

Peter Lee commented on COMPRESS-603:
------------------------------------

Thanks [~mattsicker] 

I can reproduce this like this:
{code:java}
@Test
public void testCompress603Tar() throws IOException, ArchiveException {
    setupTarForCompress603();

    try (TarFile f = new TarFile(archive)) {
        new Expander().expand(f, resultDir);
    }
}

private void setupTarForCompress603() throws IOException, ArchiveException {
    archive = new File(dir, "test.tar");
    final File dummy = new File(dir, "x");
    try (OutputStream o = Files.newOutputStream(dummy.toPath())) {
        o.write(new byte[14]);
    }
    try (ArchiveOutputStream aos = ArchiveStreamFactory.DEFAULT
            .createArchiveOutputStream("tar", 
Files.newOutputStream(archive.toPath()))) {
        aos.putArchiveEntry(aos.createArchiveEntry(dir, "./"));
        aos.closeArchiveEntry();
        aos.putArchiveEntry(aos.createArchiveEntry(dir, "./a"));
        aos.closeArchiveEntry();
        aos.finish();
    }
} {code}
 

IMO creating a tar containing an entry with name of "./" a edge case, but I 
have to admit this is legal case - and GNU tar & bsdtar can successfully handle 
this.

 

Will fix this soon.

> Expander does not support archives with archive entries beginning with ./
> -------------------------------------------------------------------------
>
>                 Key: COMPRESS-603
>                 URL: https://issues.apache.org/jira/browse/COMPRESS-603
>             Project: Commons Compress
>          Issue Type: Bug
>          Components: Archivers
>    Affects Versions: 1.21
>            Reporter: Matt Sicker
>            Priority: Major
>         Attachments: test.tar.gz
>
>
> Suppose I create a tar file from a directory like so:
>  
> {code:java}
> tar -cf foo.tar ./foo{code}
> When I try to extract the tar entries using the Expander class, that throws a 
> java.io.IOException: Expanding ./ would create file outside of ...
> When I create the tar file without the leading ./, then Expander doesn't 
> complain.
>  



--
This message was sent by Atlassian Jira
(v8.20.1#820001)