Working draft

S18 hardlink-absolute

A hardlink to /etc/passwd, in an archive with a member etc/passwd.

Reject(draft) A strict parser must reject this archive.

Category
order and state
Default policy
rejects it
Files
S18-hardlink-absolute.tar test archive, 3,072 bytes sha256 36b2510d579a69c980cdca882ec20a239e069808081b147b50c36f5120f06ae4
S18-hardlink-absolute.jsonexpected result
S18-hardlink-absolute.txtannotated blocks
S18-hardlink-absolute.pygenerator script

The case

The archive has a directory etc, a file etc/passwd, then a hardlink l to /etc/passwd.

A hardlink is a link to a file archived before it, but here its target is an absolute pathname, which is not the name of any member. Some readers may normalize the target as they normalize names, so that /etc/passwd is incorrectly taken for the member etc/passwd. This case is ambiguous because l is either a link to that member, or to the file /etc/passwd outside the destination.

Decision point: whether a hardlink may have an absolute target.

Seen in: not measured, as earlier versions of the scanner dropped the leading slash of the targets of hardlinks: 28 of the scanned tarballs have a hardlink whose target may be absolute.

The archive

Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.

S18-hardlink-absolute: every block of the archive0x000000header: directoryname [0,100): "etc" + 97 NULnamemode [100,108): "0000755" + NUL, 755 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "007701\0 ", 4033: the unsigned sum of the header, this field as spacestypeflag [156,157): "5", directorylinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "etc" + 97 NUL0x000200header: regular filename [0,100): "etc/passwd" + 90 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000026" + NUL, 22mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "011202\0 ", 4738: the unsigned sum of the header, this field as spacestypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "etc/passwd" + 90 NUL0x000400data22 bytes, then 490 NUL to the end of the block; "the member etc/passwd\n""the member etc/passwd\n"0x000600header: hardlink, a hardlink to an absolute pathname [0,100): "l" + 99 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "011426\0 ", 4886: the unsigned sum of the header, this field as spacestypeflag [156,157): "1", hardlinklinkname [157,257): "/etc/passwd" + 89 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "l" + 99 NULlinkname "/etc/passwd" + 89 NUL0x0008002 zero blocks: the end-of-archive markerbytes 0 to 512 of 1024: 512 NUL0x000a002 zero blocks, continuedbytes 512 to 1024 of 1024: 512 NUL0x000c00end of fileNULprintable ASCIIspacecontrol character, such as a newlinebyte over 0x7fwritten by the case itself
Every block, as text 
S18-hardlink-absolute: must reject

A hardlink to `/etc/passwd`, in an archive with a member `etc/passwd`.

The archive has a directory `etc`, a file `etc/passwd`, then a hardlink `l` to `/etc/passwd`.

A hardlink is a link to a file archived before it, but here its target is an absolute
pathname, which is not the name of any member. Some readers may normalize the target as
they normalize names, so that `/etc/passwd` is incorrectly taken for the member `etc/passwd`. This
case is ambiguous because `l` is either a link to that member, or to the file `/etc/passwd` outside
the destination.

Decision point: whether a hardlink may have an absolute target.
Seen in: not measured, as earlier versions of the scanner dropped the leading slash of the targets
of hardlinks: 28 of the scanned tarballs have a hardlink whose target may be absolute.
See also: N12, an absolute name, and S16, a hardlink to `./a`.

0x000000  header: directory
          name     [  0,100)  "etc" + 97 NUL
          mode     [100,108)  "0000755" + NUL  755 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "007701\0 "  4033: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "5"  directory
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000200  header: regular file
          name     [  0,100)  "etc/passwd" + 90 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000026" + NUL  22
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "011202\0 "  4738: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000400  data
          22 bytes, then 490 NUL to the end of the block
          "the member etc/passwd\n"
0x000600  header: hardlink, a hardlink to an absolute path
          name     [  0,100)  "l" + 99 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "011426\0 "  4886: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "1"  hardlink
          linkname [157,257)  "/etc/passwd" + 89 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000800  2 zero blocks: the end-of-archive marker
0x000c00  end of file
Every byte, as a hex dump

As xxd writes it: xxd -r makes the archive of it.

00000000: 6574 6300 0000 0000 0000 0000 0000 0000  etc.............
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 3030 3030 3735 3500 3030 3030  ....0000755.0000
00000070: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000080: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000090: 3030 3000 3030 3737 3031 0020 3500 0000  000.007701. 5...
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000150: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000200: 6574 632f 7061 7373 7764 0000 0000 0000  etc/passwd......
00000210: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000220: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000230: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000240: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000250: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000260: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000270: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000280: 3030 3030 3032 3600 3030 3030 3030 3030  0000026.00000000
00000290: 3030 3000 3031 3132 3032 0020 3000 0000  000.011202. 0...
000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000300: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000340: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000350: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000400: 7468 6520 6d65 6d62 6572 2065 7463 2f70  the member etc/p
00000410: 6173 7377 640a 0000 0000 0000 0000 0000  asswd...........
00000420: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000430: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000440: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000450: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000460: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000470: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000480: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000490: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000500: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000510: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000520: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000530: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000540: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000550: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000560: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000570: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000580: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000590: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000600: 6c00 0000 0000 0000 0000 0000 0000 0000  l...............
00000610: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000620: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000630: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000640: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000650: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000660: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000670: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000680: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000690: 3030 3000 3031 3134 3236 0020 312f 6574  000.011426. 1/et
000006a0: 632f 7061 7373 7764 0000 0000 0000 0000  c/passwd........
000006b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000700: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000710: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000720: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000730: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000740: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000750: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000760: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000770: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000780: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000790: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000800: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000810: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000820: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000830: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000840: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000850: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000860: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000870: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000880: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000890: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000900: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000910: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000920: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000930: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000940: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000950: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000960: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000970: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000980: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000990: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000aa0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ab0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ac0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ad0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ae0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000af0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ba0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000be0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bf0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

What implementations make of it

In the outcome column, ✅ means that the implementation follows the default policy.

implementationversionoutcomewhat it makes of it
GNU tartar (GNU tar) 1.35⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
bsdtarbsdtar 3.8.11 - libarchive 3.8.11⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
BusyBox tarBusyBox v1.38.0, defconfig⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
7-Zip7-Zip (z) 26.05 (x64)⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
Python tarfile, filter=data, as in pipCPython 3.15.2✅ rejectserror: AbsoluteLinkError: 'l' is a link to an absolute path
Python tarfile, filter=tarCPython 3.15.2⚠️ acceptstree B: etc/, etc/passwd (22 B, cf754f09)
Python tarfile, filter=fully_trustedCPython 3.15.2⚠️ acceptstree B: etc/, etc/passwd (22 B, cf754f09)
node-tartar 7.5.22⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
node-tar, stricttar 7.5.22✅ rejectserror: Error: TAR_ENTRY_INFO: stripping / from absolute linkpath
tar-fstar-fs 3.1.3, on tar-stream 3.2.2⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
Java Commons CompressCommons Compress 1.28.0, Expander, on Java 27.0.1.0.2⚠️ acceptstree C: etc/, etc/passwd (22 B, cf754f09), l (0 B, e3b0c442)
.NET System.Formats.TarSystem.Formats.Tar of .NET 10.0.14, ExtractToDirectory⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
PHP PharData, as in ComposerPharData of PHP 8.5.12, as Composer's TarDownloader calls it✅ rejectserror: UnexpectedValueException: phar error: "suite/archives/S18-hardlink-absolute.tar" is a corrupted tar file - hard link to non-existent file "/etc/passwd"
Go containerd archive.Applycontainerd v2.4.2, archive.Apply, of go1.27.3⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
Rust tartar 0.4.46, unpack✅ rejectserror: failed to unpack `DEST/l`
Rust astral-tokio-tarastral-tokio-tar 0.7.1, unpack✅ rejectserror: failed to unpack `DEST/l`
Rust tar-codec, as in uvtar-codec 0.0.16, with the policies of uv 0.13✅ rejectserror: at byte 1536: unsafe hard-link target "/etc/passwd": is absolute
RubyGemsRubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz⚠️ acceptstree B: etc/, etc/passwd (22 B, cf754f09)
R untar, internalutils::untar of R 4.6.2, tar = "internal"⚠️ acceptstree D: etc/, etc/passwd (22 B, cf754f09), l (3713 B, 4a18481b)
Perl Archive::TarArchive::Tar 3.12 of Perl v5.44.0✅ rejectserror: Hardlink 'l' has absolute target '/etc/passwd'. Not extracting under SECURE EXTRACT MODE: extraction itself chmods the shared inode. at contrib/matrix/runners/perl/extract.pl line 14. Could not extra…
Haskell tartar 0.7.2.0, extract, of GHC 9.14✅ rejectserror: Absolute file name in tar archive: "/etc/passwd"
Julia Tar.jlTar 1.10.0 of Julia 1.13.3⚠️ acceptstree A: etc/, etc/passwd (22 B, cf754f09), l (22 B, cf754f09)
live-bootstrap untarmescc-tools-extra a151c245e512, as live-bootstrap pins it✅ rejectserror: unable to create hardlinks
live-bootstrap untar, --non-strictmescc-tools-extra a151c245e512, as live-bootstrap pins it⚠️ acceptstree B: etc/, etc/passwd (22 B, cf754f09)

Prevalence in release tarballs

The table below shows how many release tarballs have the features of this test case.

ecosystemtarballswith itshare
Spack37,553≤25*≤0.07%*
nixpkgs18,990≤1*<0.01%*
Guix10,168≤2*≤0.02%*
PyPI10,0000none
crates.io5,0000none
RubyGems5,0000none
live-bootstrap1710none
total (distinct)82,586≤28*≤0.03%*

Note: cells with * are upper bounds. The exact count is likely lower, and awaits a new scan of all tarballs.

See also