Deleted Added
sdiff udiff text old ( 305188 ) new ( 306321 )
full compact
test_write_disk_secure746.c (305188) test_write_disk_secure746.c (306321)
1/*-
2 * Copyright (c) 2003-2007,2016 Tim Kientzle
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright

--- 9 unchanged lines hidden (view full) ---

18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25#include "test.h"
1/*-
2 * Copyright (c) 2003-2007,2016 Tim Kientzle
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright

--- 9 unchanged lines hidden (view full) ---

18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25#include "test.h"
26__FBSDID("$FreeBSD: stable/11/contrib/libarchive/libarchive/test/test_write_disk_secure746.c 305188 2016-09-01 07:53:59Z mm $");
26__FBSDID("$FreeBSD: stable/11/contrib/libarchive/libarchive/test/test_write_disk_secure746.c 306321 2016-09-25 22:02:27Z mm $");
27
28#define UMASK 022
29
30/*
31 * Github Issue #746 describes a problem in which hardlink targets are
32 * not adequately checked and can be used to modify entries outside of
33 * the sandbox.
34 */

--- 23 unchanged lines hidden (view full) ---

58
59 /* Create an archive_write_disk object. */
60 assert((a = archive_write_disk_new()) != NULL);
61 archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_NODOTDOT);
62
63 /* Attempt to hardlink to the target directory. */
64 assert((ae = archive_entry_new()) != NULL);
65 archive_entry_copy_pathname(ae, "bar");
27
28#define UMASK 022
29
30/*
31 * Github Issue #746 describes a problem in which hardlink targets are
32 * not adequately checked and can be used to modify entries outside of
33 * the sandbox.
34 */

--- 23 unchanged lines hidden (view full) ---

58
59 /* Create an archive_write_disk object. */
60 assert((a = archive_write_disk_new()) != NULL);
61 archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_NODOTDOT);
62
63 /* Attempt to hardlink to the target directory. */
64 assert((ae = archive_entry_new()) != NULL);
65 archive_entry_copy_pathname(ae, "bar");
66 archive_entry_set_mode(ae, S_IFREG | 0777);
66 archive_entry_set_mode(ae, AE_IFREG | 0777);
67 archive_entry_set_size(ae, 8);
68 archive_entry_copy_hardlink(ae, "../target/foo");
69 assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
67 archive_entry_set_size(ae, 8);
68 archive_entry_copy_hardlink(ae, "../target/foo");
69 assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
70 assertEqualInt(ARCHIVE_FAILED, archive_write_data(a, "modified", 8));
70 assertEqualInt(ARCHIVE_FATAL, archive_write_data(a, "modified", 8));
71 archive_entry_free(ae);
72
73 /* Verify that target file contents are unchanged. */
74 assertTextFileContents("unmodified", "../target/foo");
75#endif
76}
77
78/*

--- 21 unchanged lines hidden (view full) ---

100
101 /* Create an archive_write_disk object. */
102 assert((a = archive_write_disk_new()) != NULL);
103 archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_SYMLINKS);
104
105 /* Create a symlink to the target directory. */
106 assert((ae = archive_entry_new()) != NULL);
107 archive_entry_copy_pathname(ae, "symlink");
71 archive_entry_free(ae);
72
73 /* Verify that target file contents are unchanged. */
74 assertTextFileContents("unmodified", "../target/foo");
75#endif
76}
77
78/*

--- 21 unchanged lines hidden (view full) ---

100
101 /* Create an archive_write_disk object. */
102 assert((a = archive_write_disk_new()) != NULL);
103 archive_write_disk_set_options(a, ARCHIVE_EXTRACT_SECURE_SYMLINKS);
104
105 /* Create a symlink to the target directory. */
106 assert((ae = archive_entry_new()) != NULL);
107 archive_entry_copy_pathname(ae, "symlink");
108 archive_entry_set_mode(ae, AE_IFLNK | 0777);
108 archive_entry_copy_symlink(ae, "../target");
109 archive_entry_copy_symlink(ae, "../target");
109 assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
110 assertEqualIntA(a, ARCHIVE_OK, archive_write_header(a, ae));
110 archive_entry_free(ae);
111
112 /* Attempt to hardlink to the target directory via the symlink. */
113 assert((ae = archive_entry_new()) != NULL);
114 archive_entry_copy_pathname(ae, "bar");
111 archive_entry_free(ae);
112
113 /* Attempt to hardlink to the target directory via the symlink. */
114 assert((ae = archive_entry_new()) != NULL);
115 archive_entry_copy_pathname(ae, "bar");
115 archive_entry_set_mode(ae, S_IFREG | 0777);
116 archive_entry_set_mode(ae, AE_IFREG | 0777);
116 archive_entry_set_size(ae, 8);
117 archive_entry_copy_hardlink(ae, "symlink/foo");
117 archive_entry_set_size(ae, 8);
118 archive_entry_copy_hardlink(ae, "symlink/foo");
118 assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
119 assertEqualInt(ARCHIVE_FAILED, archive_write_data(a, "modified", 8));
119 assertEqualIntA(a, ARCHIVE_FAILED, archive_write_header(a, ae));
120 assertEqualIntA(a, ARCHIVE_FATAL, archive_write_data(a, "modified", 8));
120 archive_entry_free(ae);
121
122 /* Verify that target file contents are unchanged. */
123 assertTextFileContents("unmodified", "../target/foo");
121 archive_entry_free(ae);
122
123 /* Verify that target file contents are unchanged. */
124 assertTextFileContents("unmodified", "../target/foo");
125
126 assertEqualIntA(a, ARCHIVE_FATAL, archive_write_close(a));
127 archive_write_free(a);
124#endif
125}
128#endif
129}