5 ms·
Gnu tar happily connects to remote hosts, depending on filename
Today I Learned:
$ tar xvzf wtf:foo.tar
tar (child): Cannot connect to wtf: resolve failed
Apparently the ":" in the filename tells tar to connect to "wtf" using the "rsh" command (aliased to "ssh").
There is no mention of this in the man page: http://linuxcommand.org/lc3_man_pages/tar1.html ; apart from the rather surprising --rsh-command and --rmt-command options.
This actually is documented in the "info" pages:
http://www.gnu.org/software/tar/manual/tar.html#SEC152 :
‘-f [hostname:]file’
‘--file=[hostname:]file’
Use archive file or device file on hostname.
If the file name contains a ‘:’, it is interpreted as ‘hostname:file
name’. If the hostname contains an at sign (‘@’), it is treated as
‘user@hostname:file name’. In either case, tar will invoke the command
rsh (or remsh) to start up an /usr/libexec/rmt on the remote machine
Isn't it dangerous that a random filename could trigger "tar" to connect to remote hosts ?
- kwhitefoot 13y agoIn what way? I mean to say that I could probably think of something, but do you have some specific danger in mind?
- mjn 13y agoThe colon's a legal character in Unix filenames, so it's possible someone could send you a file named somehostname:foo.tar and convince you to run tar on it. Of course, if you quote the filename or escape the \:, as bash autocompletion would do, it wouldn't be an issue, but I could imagine some possible scenario.
- munimkazia 13y agoIt doesn't look particularly dangerous, but it could be irritating if your filename has a colon character in it. Still, I never heard of this usage of tar before, and I routinely manage several score linux servers. Pretty surprising.