Re: Bug#149454: uudecode bug (?)

[Andreas Schwab]

address@hidden (martin f krafft) writes:

|> also sprach Santiago Vila <address@hidden> [2002.07.09.1159 +0200]:
|> > > This I dig. However, other tools, like gunzip replace pipes and
|> > > symlinks rather than following them. So at the very least, it's not
|> > > standardized across GNU tools.
|> > 
|> > gzip is an exception, because it removes the original file when
|> > compressing a file, removes the .gz file when uncompressing it, and
|> > usually refuses to overwrite an uncompressed file or a compressed one
|> > if it already exists, but the general Unix rule is to follow symlinks.
|> 
|> tar -- which is much closer to uudecode than gzip -- exhibits the same
|> behaviour: it replaces an existing file, even if it's a symlink or
|> a pipe:
|> 
|> fishbowl% echo test > tar-link
|> fishbowl% echo test > tar-pipe
|> fishbowl% tar cf test.tar tar-*
|> fishbowl% echo not a test > a-file
|> fishbowl% ln -sf a-file tar-link
|> fishbowl% rm tar-pipe && mkfifo tar-pipe
|> fishbowl% ls -la tar-* a-file
|> -rw-r--r--    1 madduck  users          11 Jul  9 12:29 a-file
|> lrwxrwxrwx    1 madduck  users           6 Jul  9 12:30 tar-link -> a-file
|> prw-r--r--    1 madduck  users           0 Jul  9 12:30 tar-pipe
|> fishbowl% tar xf test.tar
|> fishbowl% ls -la tar-* a-file
|> -rw-r--r--    1 madduck  users          11 Jul  9 12:29 a-file
|> -rw-r--r--    1 madduck  users           5 Jul  9 12:29 tar-link
|> -rw-r--r--    1 madduck  users           5 Jul  9 12:29 tar-pipe
|> 
|> is tar also an exception?

If tar would follow symlinks that would be a security bug.  Also, tar
works on directory contents in addition to files and it's its duty to
restore the contents of the archive so that afterwards the extracted files
are identical to the copy in the archive.

Andreas.

-- 
Andreas Schwab, SuSE Labs, address@hidden
SuSE Linux AG, Deutschherrnstr. 15-19, D-90429 Nürnberg
Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."