Working draft

S19 tree-through-symlink-inside

A member written through a symlink that points inside the destination.

Reject(draft) A strict parser must reject this archive.

Category
order and state
Default policy
rejects it
Files
S19-tree-through-symlink-inside.tar test archive, 3,584 bytes sha256 641579e8ac96339efa5ce81277f4620cf73080bca39c1f87d54d2118afc5d410
S19-tree-through-symlink-inside.jsonexpected result
S19-tree-through-symlink-inside.txtannotated blocks
S19-tree-through-symlink-inside.pygenerator script

The case

The archive has the directories d and x, a symlink x/l to ../d, then a file x/l/f.

In POSIX, files are created by pathname resolution, which follows the link, so the file is written to d/f, inside the destination. This case is ambiguous in practice because a reader that writes through the link extracts d/f, and one that does not either fails or skips f. A reader that creates symlinks after the other members writes f to a directory x/l, and then fails to create the link. It is rejected, as is writing through any symlink: a reader that writes through links stays inside the destination only if it resolves each link at every write.

Decision point: whether a member may be written through a symlink.

Seen in: none of the scanned tarballs.

The archive

Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.

S19-tree-through-symlink-inside: every block of the archive0x000000header: directoryname [0,100): "d" + 99 NULnamemode [100,108): "0000755" + NUL, 755 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "007351\0 ", 3817: the unsigned sum of the header, this field as spacestypeflag [156,157): "5", directorylinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "d" + 99 NUL0x000200header: directoryname [0,100): "x" + 99 NULnamemode [100,108): "0000755" + NUL, 755 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "007375\0 ", 3837: the unsigned sum of the header, this field as spacestypeflag [156,157): "5", directorylinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "x" + 99 NUL0x000400header: symlinkname [0,100): "x/l" + 97 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "010201\0 ", 4225: the unsigned sum of the header, this field as spacestypeflag [156,157): "2", symlinklinkname [157,257): "../d" + 96 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "x/l" + 97 NULlinkname "../d" + 96 NUL0x000600header: regular file, written through x/l, to d/fname [0,100): "x/l/f" + 95 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000002" + NUL, 2mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "010047\0 ", 4135: the unsigned sum of the header, this field as spacestypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "x/l/f" + 95 NUL0x000800data2 bytes, then 510 NUL to the end of the block; "f\n""f\n"0x000a002 zero blocks: the end-of-archive markerbytes 0 to 512 of 1024: 512 NUL0x000c002 zero blocks, continuedbytes 512 to 1024 of 1024: 512 NUL0x000e00end of fileNULprintable ASCIIspacecontrol character, such as a newlinebyte over 0x7fwritten by the case itself
Every block, as text 
S19-tree-through-symlink-inside: must reject

A member written through a symlink that points inside the destination.

The archive has the directories `d` and `x`, a symlink `x/l` to `../d`, then a file `x/l/f`.

In POSIX, files are created by pathname resolution, which follows
the link, so the file is written to `d/f`, inside the destination. This case is ambiguous in
practice because a reader that writes through the link extracts `d/f`, and one that does not either
fails or skips `f`. A reader that creates symlinks after the other members writes `f` to a directory
`x/l`, and then fails to create the link. It is rejected, as is writing through any symlink: a
reader that writes through links stays inside the destination only if it resolves each link at every
write.

Decision point: whether a member may be written through a symlink.
Seen in: none of the scanned tarballs.
See also: S10, a file at the path of a symlink, and S11, a member written through a symlink that
points out of the destination.

0x000000  header: directory
          name     [  0,100)  "d" + 99 NUL
          mode     [100,108)  "0000755" + NUL  755 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "007351\0 "  3817: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "5"  directory
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000200  header: directory
          name     [  0,100)  "x" + 99 NUL
          mode     [100,108)  "0000755" + NUL  755 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "007375\0 "  3837: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "5"  directory
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000400  header: symlink
          name     [  0,100)  "x/l" + 97 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "010201\0 "  4225: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "2"  symlink
          linkname [157,257)  "../d" + 96 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000600  header: regular file, written through x/l, to d/f
          name     [  0,100)  "x/l/f" + 95 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000002" + NUL  2
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "010047\0 "  4135: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000800  data
          2 bytes, then 510 NUL to the end of the block
          "f\n"
0x000a00  2 zero blocks: the end-of-archive marker
0x000e00  end of file
Every byte, as a hex dump

As xxd writes it: xxd -r makes the archive of it.

00000000: 6400 0000 0000 0000 0000 0000 0000 0000  d...............
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 3030 3030 3735 3500 3030 3030  ....0000755.0000
00000070: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000080: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000090: 3030 3000 3030 3733 3531 0020 3500 0000  000.007351. 5...
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000150: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000200: 7800 0000 0000 0000 0000 0000 0000 0000  x...............
00000210: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000220: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000230: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000240: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000250: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000260: 0000 0000 3030 3030 3735 3500 3030 3030  ....0000755.0000
00000270: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000280: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000290: 3030 3000 3030 3733 3735 0020 3500 0000  000.007375. 5...
000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000300: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000340: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000350: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000400: 782f 6c00 0000 0000 0000 0000 0000 0000  x/l.............
00000410: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000420: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000430: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000440: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000450: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000460: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000470: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000480: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000490: 3030 3000 3031 3032 3031 0020 322e 2e2f  000.010201. 2../
000004a0: 6400 0000 0000 0000 0000 0000 0000 0000  d...............
000004b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000500: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000510: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000520: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000530: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000540: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000550: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000560: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000570: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000580: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000590: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000600: 782f 6c2f 6600 0000 0000 0000 0000 0000  x/l/f...........
00000610: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000620: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000630: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000640: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000650: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000660: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000670: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000680: 3030 3030 3030 3200 3030 3030 3030 3030  0000002.00000000
00000690: 3030 3000 3031 3030 3437 0020 3000 0000  000.010047. 0...
000006a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000700: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000710: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000720: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000730: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000740: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000750: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000760: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000770: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000780: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000790: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000800: 660a 0000 0000 0000 0000 0000 0000 0000  f...............
00000810: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000820: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000830: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000840: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000850: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000860: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000870: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000880: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000890: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000900: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000910: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000920: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000930: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000940: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000950: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000960: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000970: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000980: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000990: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000aa0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ab0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ac0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ad0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ae0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000af0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ba0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000be0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bf0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ca0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000cb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000cc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000cd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ce0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000cf0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000da0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000db0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000dc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000dd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000de0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000df0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

What implementations make of it

In the outcome column, ✅ means that the implementation follows the default policy.

implementationversionoutcomewhat it makes of it
GNU tartar (GNU tar) 1.35✅ rejectserror: tar: x/l/f: Cannot open: Not a directory tar: Exiting with failure status due to previous errors
bsdtarbsdtar 3.8.11 - libarchive 3.8.11✅ rejectserror: x/l/f: Cannot extract through symlink x/l/f: Too many levels of symbolic links bsdtar: Error exit delayed from previous errors
BusyBox tarBusyBox v1.38.0, defconfig✅ rejectserror: tar: can't create symlink 'x/l' to '../d'
7-Zip7-Zip (z) 26.05 (x64)✅ rejectserror: ERROR: Cannot open output file : errno=20 : Not a directory : DEST/x/l/f ERROR: Dangerous link path was ignored : x/l : ../d
Python tarfile, filter=data, as in pipCPython 3.15.2⚠️ acceptstree A: d/, d/f (2 B, 092fcfbb), x/, x/l → ../d
Python tarfile, filter=tarCPython 3.15.2⚠️ acceptstree A: d/, d/f (2 B, 092fcfbb), x/, x/l → ../d
Python tarfile, filter=fully_trustedCPython 3.15.2⚠️ acceptstree A: d/, d/f (2 B, 092fcfbb), x/, x/l → ../d
node-tartar 7.5.22⚠️ acceptstree B: d/, x/, x/l → ../d
node-tar, stricttar 7.5.22✅ rejectserror: SymlinkError: TAR_SYMLINK_ERROR: Cannot extract through symbolic link
tar-fstar-fs 3.1.3, on tar-stream 3.2.2✅ rejectserror: Error: DEST/x/l is not a valid path
Java Commons CompressCommons Compress 1.28.0, Expander, on Java 27.0.1.0.2✅ rejectserror: java.nio.file.FileAlreadyExistsException: DEST/x/l
.NET System.Formats.TarSystem.Formats.Tar of .NET 10.0.14, ExtractToDirectory✅ rejectserror: IOException: The file 'DEST/x/l' already exists.
PHP PharData, as in ComposerPharData of PHP 8.5.12, as Composer's TarDownloader calls it✅ rejectserror: Warning: PharData::extractTo(DEST/x/l/f): Failed to open stream: No such file or directory in contrib/matrix/runners/php/extract.php on line 10 PharException: Extraction from phar "suite/archives/S19…
Go containerd archive.Applycontainerd v2.4.2, archive.Apply, of go1.27.3⚠️ acceptstree A: d/, d/f (2 B, 092fcfbb), x/, x/l → ../d
Rust tartar 0.4.46, unpack✅ rejectserror: No such file or directory (os error 2) while canonicalizing DEST/x/l
Rust astral-tokio-tarastral-tokio-tar 0.7.1, unpack✅ rejectserror: No such file or directory (os error 2) while canonicalizing DEST/x/l
Rust tar-codec, as in uvtar-codec 0.0.16, with the policies of uv 0.13✅ rejectserror: archive entry collides with existing path x/l
RubyGemsRubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz✅ rejectserror: Errno::EEXIST: File exists @ syserr_fail2_in - DEST/x/l
R untar, internalutils::untar of R 4.6.2, tar = "internal"✅ rejectserror: cannot extract through symlink
Perl Archive::TarArchive::Tar 3.12 of Perl v5.44.0✅ rejectserror: Entry 'x/l/f' is attempting to extract to a symlinked directory (DEST/x/l => ../d). This is considered a security vulnerability and not allowed under SECURE EXTRACT MODE at contrib/matrix/runners/per…
Haskell tartar 0.7.2.0, extract, of GHC 9.14✅ rejectserror: createDirectoryLink:createSymbolicLink '../d' to 'DEST/x/l': already exists (File exists)
Julia Tar.jlTar 1.10.0 of Julia 1.13.3✅ rejectserror: Tarball contains path with symlink prefix: - path = "x/l/f" - prefix = "x/l" Refusing to extract — possible attack!
live-bootstrap untarmescc-tools-extra a151c245e512, as live-bootstrap pins it⚠️ acceptstree A: d/, d/f (2 B, 092fcfbb), x/, x/l → ../d
live-bootstrap untar, --non-strictmescc-tools-extra a151c245e512, as live-bootstrap pins it⚠️ acceptstree A: d/, d/f (2 B, 092fcfbb), x/, x/l → ../d

Prevalence in release tarballs

The table below shows how many release tarballs have the features of this test case.

ecosystemtarballswith itshare
Spack37,5530none
nixpkgs18,9900none
Guix10,1680none
PyPI10,0000none
crates.io5,0000none
RubyGems5,0000none
live-bootstrap1710none
total (distinct)82,5860none

See also