Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Protect .cargo-ok on case-insensitive file systems #13669

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

kornelski
Copy link
Contributor

Tar decompression is trying to forbid .cargo-ok from being expanded from the archive, but it's performing an exact string check, which is effective only on case-sensitive file systems. On macOS and Windows a .CARGO-OK (or some other combination of upper case letters) can create a file that has the same path as .cargo-ok.

@rustbot
Copy link
Collaborator

rustbot commented Mar 30, 2024

r? @epage

rustbot has assigned @epage.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@rustbot rustbot added A-registries Area: registries S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Mar 30, 2024
Copy link
Member

@weihanglo weihanglo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this line already protects them from overwrites, though your patch seems also reasonable. Could you add a test to prevent future regression?

@epage
Copy link
Contributor

epage commented Mar 30, 2024

When adding the test, please make it its own commit first and having passing, showing the bad behavior. Then in the commit with your fix, it will be updated to show the change in behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-registries Area: registries S-waiting-on-review Status: Awaiting review from the assignee but also interested parties.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants