-
Notifications
You must be signed in to change notification settings - Fork 182
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix directory traversal security issues with Archive::unpack().
Similar to directory traversal security issues that have affected GNU tar in the past, Archive::unpack() should not allow '..' to be used to overwrite arbitrary files. While I was in this area, I also made the following changes: - Remove `#[cfg(feature = "nightly")]` and provide a fallback for unix and Rust stable that calls libc::chmod() instead. - Fix the issue that set_perms() was not calling APIs that persisted the permissions changes. Permissions::set_readonly() does not modify the filesystem and presumably PermissionsExt::set_mode() does not, either. - Ignore AlreadyExists errors from fs::create_dir_all().
- Loading branch information
1 parent
288a975
commit 2362a66
Showing
2 changed files
with
157 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.