From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: zipbomb handling should not be done in url-fetch/zipbomb Date: Wed, 21 Jun 2017 12:45:10 +0200 Message-ID: <87r2ydipqh.fsf@gnu.org> References: <9f5ff0ec.AEAALfWcKw0AAAAAAAAAAAOtZhgAAAACwQwAAAAAAAW9WABZQ6jZ@mailjet.com> <878tkqbceq.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:35073) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dNd8Q-0005Lm-RW for guix-devel@gnu.org; Wed, 21 Jun 2017 06:45:19 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dNd8N-0000jv-0L for guix-devel@gnu.org; Wed, 21 Jun 2017 06:45:18 -0400 In-Reply-To: (Arun Isaac's message of "Wed, 21 Jun 2017 00:19:44 +0530") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Arun Isaac Cc: guix-devel@gnu.org Arun Isaac skribis: >>> * Proposal >>> >>> zip bomb (zip archives without a top level directory) handling should >>> not be done in `url-fetch/zipbomb'. It should be implemented as a >>> boolean argument to the `unpack' phase. >> >> I guess the Boolean argument would determine whether to do (chdir >> (first-subdirectory ".")), right? >> >> Unfortunately that=E2=80=99s not enough for the cases where an origin has >> patches or a snippet, because that code also assumes there=E2=80=99s onl= y one >> subdirectory (see =E2=80=98patch-and-repack=E2=80=99 in (guix packages)). > > Ah, I didn't think of that. > >> Perhaps the right fix would be to fix =E2=80=98patch-and-repack=E2=80=99= somehow. > > Unfortunately, I don't know what that fix would look like. :-( Perhaps > `patch-and-repack' should somehow autodetect whether the archive is a > bomb or not. Do you think that is a good solution? It sounds > overcomplicated to me. Yeah, I don=E2=80=99t really know either. It could certainly detect that unpacking created more than one file, and maybe it could automatically create a directory and move everything there. It=E2=80=99s a bit complicated for the occasional tarbomb, indeed=E2=80=A6 > Or, we can just let this matter rest as it is not too important. Maybe! Thanks, Ludo=E2=80=99.