Develop and Download Open Source Software

Browse Subversion Repository

Contents of /hamigaki/trunk/libs/archivers/example/wuntar.cpp

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1782 - (show annotations) (download) (as text)
Sun Jun 10 06:01:53 2018 UTC (5 years, 9 months ago) by hamigaki
File MIME type: text/x-c++src
File size: 4242 byte(s)
fix for Zip Slip
1 // untar.cpp: a simple tar extracting program (Unicode version)
2
3 // Copyright Takeshi Mouri 2008-2018.
4 // Distributed under the Boost Software License, Version 1.0.
5 // (See accompanying file LICENSE_1_0.txt or copy at
6 // http://www.boost.org/LICENSE_1_0.txt)
7
8 // See http://hamigaki.sourceforge.jp/libs/archivers for library home page.
9
10
11 // Security warning:
12 // This program never check the validity of paths in the archive.
13 // See http://www.forest.impress.co.jp/article/2004/07/30/arcsecurity.html .
14 // (The above link is Japanese site)
15
16
17 #include <hamigaki/archivers/tar_file.hpp>
18 #include <hamigaki/filesystem/operations.hpp>
19 #include <boost/filesystem/convenience.hpp>
20 #include <boost/filesystem/fstream.hpp>
21 #include <boost/iostreams/copy.hpp>
22 #include <clocale>
23 #include <exception>
24 #include <iostream>
25
26 namespace ar = hamigaki::archivers;
27 namespace fs_ex = hamigaki::filesystem;
28 namespace io_ex = hamigaki::iostreams;
29 namespace fs = boost::filesystem;
30 namespace io = boost::iostreams;
31
32 template<class Path>
33 inline bool has_parent_path(const Path& ph)
34 {
35 #if BOOST_VERSION < 103600
36 return ph.has_branch_path();
37 #else
38 return ph.has_parent_path();
39 #endif
40 }
41
42 template<class Path>
43 bool is_valid_path(const Path& ph)
44 {
45 #if !defined(HAMIGAKI_ALLOW_DIRECTORY_TRAVERSAL)
46 if (ph.has_root_name() || ph.has_root_directory())
47 return false;
48 for (typename Path::iterator it = ph.begin(); it != ph.end(); ++it)
49 {
50 if (*it == L"..")
51 return false;
52 }
53 #endif
54 return true;
55 }
56
57 int main(int argc, char* argv[])
58 {
59 try
60 {
61 if (argc != 2)
62 {
63 std::cerr << "Usage: untar (archive)" << std::endl;
64 return 1;
65 }
66
67 std::setlocale(LC_ALL, "");
68
69 ar::wtar_file_source tar(argv[1]);
70
71 while (tar.next_entry())
72 {
73 const ar::tar::wheader& head = tar.header();
74
75 std::wcout << head.path << std::endl;
76 if (!is_valid_path(head.path))
77 {
78 std::cerr << "Warning: invalid path" << '\n';
79 continue;
80 }
81
82 if (head.type_flag == ar::tar::type_flag::link)
83 {
84 if (::has_parent_path(head.path))
85 fs::create_directories(head.path.branch_path());
86
87 fs_ex::create_hard_link(head.link_path, head.path);
88 }
89 else if (head.type_flag == ar::tar::type_flag::symlink)
90 {
91 if (::has_parent_path(head.path))
92 fs::create_directories(head.path.branch_path());
93
94 fs_ex::create_symlink(head.link_path, head.path);
95 }
96 else if (head.type_flag == ar::tar::type_flag::directory)
97 fs::create_directories(head.path);
98 else if (head.type_flag == ar::tar::type_flag::char_device)
99 std::cerr << "Warning: skip character device\n";
100 else if (head.type_flag == ar::tar::type_flag::block_device)
101 std::cerr << "Warning: skip block device\n";
102 else if (head.type_flag == ar::tar::type_flag::fifo)
103 std::cerr << "Warning: skip FIFO file\n";
104 // Note: All unknown types are treated as a regular file.
105 else
106 {
107 if (::has_parent_path(head.path))
108 fs::create_directories(head.path.branch_path());
109
110 fs::ofstream os(head.path, std::ios_base::binary);
111 io::copy(tar, os);
112 }
113
114 // Note:
115 // The POSIX chown() clears S_ISUID/S_ISGID bits.
116 // So, we must call change_symlink_owner()
117 // before calling change_permissions().
118 fs_ex::error_code ec;
119 fs_ex::change_symlink_owner(head.path, head.uid, head.gid, ec);
120
121 fs_ex::change_permissions(head.path, head.permissions, ec);
122
123 if (head.modified_time)
124 fs_ex::last_write_time(head.path, *head.modified_time);
125 if (head.access_time)
126 fs_ex::last_access_time(head.path, *head.access_time);
127 }
128
129 return 0;
130 }
131 catch (const std::exception& e)
132 {
133 std::cerr << "Error: " << e.what() << std::endl;
134 }
135 return 1;
136 }

Properties

Name Value
svn:eol-style native

Back to OSDN">Back to OSDN
ViewVC Help
Powered by ViewVC 1.1.26