On Sat, Sep 12, 2026 at 11:29:54PM -0600, David Leadbeater wrote: > fw_update: Make tar skip files outside expected locations > > tar(1) strips ".." path components, but this happens after globbing is > applied to the file parameter. This meant tar's -s replacements and the > file parameter examined different strings, meaning a specially > constructed archive could write outside the expected locations. Use > tar's documented order of -s expressions to skip everything else.
... ok afresh1@
