From: Sergey Poznyakoff <gray@gnu.org.ua>
Date: Wed, 3 Oct 2007 20:18:32 +0000 (+0000)
Subject: (try_purge_directory): Ensure that arguments to T and R are safe.
X-Git-Url: https://git.brokenzipper.com/gitweb?a=commitdiff_plain;h=6f6864df139cce4ef347abbf862d6ff401b23c7d;p=chaz%2Ftar

(try_purge_directory): Ensure that arguments to T and R are safe.
---

diff --git a/src/incremen.c b/src/incremen.c
index 50be010..bc5fdad 100644
--- a/src/incremen.c
+++ b/src/incremen.c
@@ -1410,6 +1410,19 @@ try_purge_directory (char const *directory_name)
 	  arc += strlen (arc) + 1;
 	  dst = arc + 1;
 
+	  /* Ensure that neither source nor destination are absolute file
+	     names (unless permitted by -P option), and that they do not
+	     contain dubious parts (e.g. ../).
+
+	     This is an extra safety precaution. Besides, it might be
+	     necessary to extract from archives created with tar versions
+	     prior to 1.19. */
+	  
+	  if (*src)
+	    src = safer_name_suffix (src, false, absolute_names_option);
+	  if (*dst)
+	    dst = safer_name_suffix (dst, false, absolute_names_option);
+	  
 	  if (*src == 0)
 	    src = temp_stub;
 	  else if (*dst == 0)