Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon.

Pages: 1-

Can you trust a ZIP file?

Name: Anonymous 2012-08-17 13:54

What guarantees that unpacking a simple ZIP file wont crash a system? What if ZIP file specifies absolute/relative pathname, pointing inside /usr/bin? What if a ZIP-file produces 16777216 files, crashing filesystem?

Name: Anonymous 2012-08-17 13:57

Extracting ../../../../bin/bash
Extracting ../../../bin/bash
Extracting ../../bin/bash
Extracting ../bin/bash
FUUUU.....

Name: Anonymous 2012-08-17 15:44

You obviously answered your own question.
Any extractor worth its salt will have an option to contain all files to a specified folder, even if the zip files includes absolute paths or relative paths that walk up the tree.
If your filesystem crashes, it was due for replacement anyway.

Name: Anonymous 2012-08-17 16:56

>>3
in case of *.TAR.GZ files, extractor has to obey absolute paths.

Name: Anonymous 2012-08-17 16:56

There are no guarantees:

http://en.wikipedia.org/wiki/Zip_bomb

Name: Anonymous 2012-08-17 17:20

>>2
back to le reddit

Name: Anonymous 2012-08-18 1:48

>>4
I believe GNU tar will strip the / from the beginning of an absolute path by default.

Name: Anonymous 2012-08-18 2:01

why would you unzip or untar a file with root privilegies?

Name: Anonymous 2012-08-18 2:03

>>7
Indeed. The GNU coreutils have much improved on their POSIX counterparts.

Last week users poured out into the streets of the network to rally to the cause of 1024-byte blocks for measuring disk space. When people finally chose sides, it was amazing how few actually stood with the POSIX Central Committee and its apparatchiks. Only 20 out of 750 supported the 512ist coup.

In the aftermath, the GNU system has declared its independence,
throwing off the power of the POSIX party. We are rapidly moving to eliminate all vestage of 512ist domination. We have already taken direct control of df, du, and several other programs, converting them to use 1024-byte units for measuring output, and to provide ways to specify input quantities in units of K.

We promise to respect the rights of minorities--even tiny ones. So there will be options to request output in units of 512. Even those who cannot bear to deviate from the POSIX party line will be provided for--they can define the environment variable POSIX_ME_HARDER.

But what we really hope is that the POSIX party will itself modernize its hardline position, and add its support to 1024ist reform. If the KGB could do it, there must at least be a chance for POSIX.

Name: Anonymous 2012-08-19 1:11

>>9
The tale of POSIX_ME_HARDER is really funny when you consider that rms is the one who named POSIX in the first place.

The net benefit of the GNU changes to the core tools, positive or negative, depends on the specific tool. tar is much improved, but the lack of a strict POSIX or Bourne compatibility mode for bash has caused no end of problems over the years.

Name: Anonymous 2012-08-20 7:50

Can you trust my doubles?

Name: Anonymous 2012-08-20 11:46

>>10
fortunately, zsh, ash, and ksh all provide what bash lacks.

Name: Anonymous 2012-08-20 20:25

TRUST MY ANUS

Don't change these.
Name: Email:
Entire Thread Thread List