From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Bavier Subject: Re: zipbomb handling should not be done in url-fetch/zipbomb Date: Sun, 18 Jun 2017 17:21:05 -0500 Message-ID: <012D1840-3FA8-4F96-8909-278E3DE75EC4@centurylink.net> References: <9f5ff0ec.AEAALfWcKw0AAAAAAAAAAAOtZhgAAAACwQwAAAAAAAW9WABZQ6jZ@mailjet.com> <878tkqbceq.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:39307) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dMiZH-000776-GO for guix-devel@gnu.org; Sun, 18 Jun 2017 18:21:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dMiZD-00020t-FG for guix-devel@gnu.org; Sun, 18 Jun 2017 18:21:15 -0400 Received: from mail.centurylink.net ([205.219.233.9]:53282 helo=smtp.centurylink.net) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dMiZD-00020N-8Z for guix-devel@gnu.org; Sun, 18 Jun 2017 18:21:11 -0400 In-Reply-To: <878tkqbceq.fsf@gnu.org> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org, ludo@gnu.org, Arun Isaac On June 17, 2017 3:13:33 PM CDT, ludo@gnu=2Eorg wrote: >Arun Isaac skribis: > >> * Proposal >> >> zip bomb (zip archives without a top level directory) handling should >> not be done in `url-fetch/zipbomb'=2E It should be implemented as a >> boolean argument to the `unpack' phase=2E > >I guess the Boolean argument would determine whether to do (chdir >(first-subdirectory "=2E")), right? > >Unfortunately that=E2=80=99s not enough for the cases where an origin has >patches or a snippet, because that code also assumes there=E2=80=99s only= one >subdirectory (see =E2=80=98patch-and-repack=E2=80=99 in (guix packages))= =2E > >Perhaps the right fix would be to fix =E2=80=98patch-and-repack=E2=80=99 = somehow=2E I think this would be preferable=2E Since it means that users of 'guix bui= ld -S' would still get "unbombed" sources=2E `~Eric --=20 Sent from my Android device with K-9 Mail=2E Please excuse my brevity=2E