3 ms·
Running xz in a sandbox would not prevent an attack that causes it to modify source code in a .tar.xz that is being streamed through it.
by joeyh 3y ago
Running xz in a sandbox would not prevent an attack that causes it to modify source code in a .tar.xz that is being streamed through it.
- JoshTriplett 3y agoNo, it wouldn't, but that wasn't the attack here. And code outside the sandbox could check a checksum of the uncompressed data, to ensure that the decompression can't misbehave.