Hello!
>> > I was taking a look into the patch and, yes it works as expected, but I >> > also manage to get the same result of a path traversal having a with a >> > symlink as follow: >> > >> > blob_16388.dat -> ../../../../../../../etc/passwd >> > >> > Probably it could be worthy to add the symlink check with lstat() ? > > Yeah that makes sense. I have fixed that. I've tested the patch and now the error it's clear: pg_restore -f testo-bad3.sql testo.dump-traversal/ pg_restore: error: invalid archive: entry file "testo.dump-traversal//blob_123.dat" is a symbolic link The only thing that it was a bit weird to me, is that the check using lstat() was made after checking the traversal path, since this check is less expensive in terms of functions calls, probably it could be worthy? Regards! -- Jonathan Gonzalez V. EDB https://www.enterprisedb.com
