4 ms·

It's nice to check if you're about to extract a 1MB tarball into 2TBs of data before actually running out of disk space. Most tar programs do prevent extractin

It's nice to check if you're about to extract a 1MB tarball into 2TBs of data before actually running out of disk space. Most tar programs do prevent extracting tarballs containing absolute paths (like '/etc/passwd') and relative paths (like '../../../etc/passwd'), but older tar programs still allow that. And programs written in Go, because of course: https://github.com/golang/go/issues/55356 https://github.com/golang/go/issues/55356 Overall, if your HDD size is infinite and you're using GNU tar, or another recent tar, you can skip 't' I think before doing a '-C' extraction into some safe directory.

vorakl 2y ago
How do you create a tar archive that "contains absolute paths"?
- 10000truths 2y ago
  The tar file format doesn't prevent you from specifying absolute paths in the archive. It's up to the tool extracting the archive to reject/ignore such paths.
  - vorakl 2y ago
    I asked about options for GNU tar because there is a bit of strange behavior. To add absolute paths to an archive, there is "-P" option, and man says it works only for creating archives: "Don't strip leading slashes from filenames when creating archives". To extract absolute paths from the archive, you need to add the "-C /" option, and although the tool says "tar: Strip leading `/' from member names", it will still extract it in the right place because the paths become relative and -C puts them in the root. However, if you add "-P" during the extraction (which is not mentioned in man), the "strip leading slashes" information disappears. So if this message bothers someone, "tar -C / -xPf file.tar" will cleanly extract absolute paths from the archive ;)
- yjftsjthsd-h 2y ago
  The first field in the tar header is char name[100]; (See https://man.archlinux.org/man/tar.5.en https://man.archlinux.org/man/tar.5.en ) So anything that will write an absolute path there, including literally opening it in a text editor and replacing the path by hand because that whole header is just fixed length ASCII with null terminated strings. (I mean I assume the tar(1) command can do it too but you don't need that, the format is dead simple, if weird.)
  - eichin 2y ago
    It's a good exercise to open one of these files in hexdump or something to get a feel for what's really going on inside... but yeah, GNU tar has -P / --absolute-names to just create them with leading slashes.

vorakl 2y ago

How do you create a tar archive that "contains absolute paths"?

10000truths 2y ago
The tar file format doesn't prevent you from specifying absolute paths in the archive. It's up to the tool extracting the archive to reject/ignore such paths.
- vorakl 2y ago
  I asked about options for GNU tar because there is a bit of strange behavior. To add absolute paths to an archive, there is "-P" option, and man says it works only for creating archives: "Don't strip leading slashes from filenames when creating archives". To extract absolute paths from the archive, you need to add the "-C /" option, and although the tool says "tar: Strip leading `/' from member names", it will still extract it in the right place because the paths become relative and -C puts them in the root. However, if you add "-P" during the extraction (which is not mentioned in man), the "strip leading slashes" information disappears. So if this message bothers someone, "tar -C / -xPf file.tar" will cleanly extract absolute paths from the archive ;)
yjftsjthsd-h 2y ago
The first field in the tar header is char name[100]; (See https://man.archlinux.org/man/tar.5.en https://man.archlinux.org/man/tar.5.en ) So anything that will write an absolute path there, including literally opening it in a text editor and replacing the path by hand because that whole header is just fixed length ASCII with null terminated strings. (I mean I assume the tar(1) command can do it too but you don't need that, the format is dead simple, if weird.)
- eichin 2y ago
  It's a good exercise to open one of these files in hexdump or something to get a feel for what's really going on inside... but yeah, GNU tar has -P / --absolute-names to just create them with leading slashes.