and stuff won't actually be scanned.
At the moment, I've got a working port of 2.65 patched to extract with
full paths. The last problem to solve is preventing path traversal
exploits. I suspect that just searching for double dot .. in the to
be created path string is not enough but since I've never
it will overwrite files and stuff won't actually be scanned.
At the moment, I've got a working port of 2.65 patched to extract with
full paths. The last problem to solve is preventing path traversal
exploits. I suspect that just searching for double dot .. in the to
be created path string
Alexander Hall wrote:
Well, a slash in the beginning of path names made me overwrite my entire
/etc dir with another machines configuration... However, that was with
tar and not unarj...
Correcting myself after some testing. It was using pax. :-)
/Alexander
it will overwrite files and stuff won't actually be scanned.
At the moment, I've got a working port of 2.65 patched to extract with
full paths. The last problem to solve is preventing path traversal
exploits. I suspect that just searching for double dot .. in the to
be created path string is not enough
Perhaps someone more experienced can comment on this one. I'm not
exactly sure, but i suspect you found nothing for the following simple
reason: if all you want to do is checking for simple path traversal
under Unix, m/^\// and m/\.\./ are all you need.
Except that it would make valid names
, I've got a working port of 2.65 patched to extract with
full paths. The last problem to solve is preventing path traversal
exploits. I suspect that just searching for double dot .. in the to
be created path string is not enough but since I've never done this
sort of thing, I'm not sure where
6 matches
Mail list logo
