busybox/archival/tar_symlink_attack
Denys Vlasenko b920a38dc0 tar: postpone creation of symlinks with "suspicious" targets. Closes 8411
function                                             old     new   delta
data_extract_all                                     968    1038     +70
tar_main                                             952     986     +34
scan_tree                                            258     262      +4
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/0 up/down: 108/0)             Total: 108 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-24 17:20:13 +02:00

17 lines
386 B
Bash
Executable File

#!/bin/sh
# Makes "symlink attack" tarball (needs GNU tar for --append)
true >anything.txt
tar cvf tar_symlink_attack.tar anything.txt
rm anything.txt
ln -s /tmp symlink
tar --append -f tar_symlink_attack.tar symlink
rm symlink
mkdir symlink
echo BUG >symlink/bb_test_evilfile
tar --append -f tar_symlink_attack.tar symlink/bb_test_evilfile
rm symlink/bb_test_evilfile
rmdir symlink