On 1/11/23 22:44, Robert Elz wrote:
But ask yourself, what if the utility in question here was tar, or pax, or cpio (or whatever it is that Solaris uses for system installs and updates)? Is there any material difference to uuencode in how they operate, or what they can do (except that tar (etc) will usually set the setuid bit in extracted files if the archive says to do that - how else would "su" ever get installed correctly?)
We can't compare the command specifications in the standard for tar, as there are none, but if we look at common implementations, they do in fact protect against issues such as those raised here with the paths: https://www.gnu.org/software/tar/manual/html_node/absolute.html "By default, GNU tar drops a leading ‘/’ on input or output, and complains about file names containing a ‘..’ component. There is an option that turns off this behavior" https://www.freebsd.org/cgi/man.cgi?query=tar&manpath=FreeBSD+13.1-RELEASE+and+Ports https://man.netbsd.org/tar.1 " -P, --absolute-paths Preserve pathnames. By default, absolute pathnames (those that begin with a / character) have the leading slash removed both when creating archives and extracting from them. Also, tar will refuse to extract archive entries whose pathnames contain .. or whose target directory would be altered by a symlink. This op- tion suppresses these behaviors." https://man.openbsd.org/tar.1 "-P Do not strip leading slashes (‘/’) from pathnames. The default is to strip leading slashes." https://docs.oracle.com/cd/E88353_01/html/E37839/tar-1.html "P For archive creation, suppress the addition of a trailing / on directory entries in the archive. For archive extraction, preserve pathnames. By default, absolute pathnames (those that begin with a / character) have the leading slash removed when extracting archives. Also, tar refuses to extract archive entries whose pathnames contain a dot-dot (..). This option suppresses these behaviors." At the very least here, I thought the standard committee would want to consider that all of the major implementations of uudecode follow a defacto standard on removing bits from the permissions that doesn't seem to be allowed by the current language of the formal standard. -- -Alan Coopersmith- alan.coopersm...@oracle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
