Warn about possible risks when extracting untrusted archives.

This commit is contained in:
Lars Gustäbel 2007-08-30 20:25:13 +00:00
parent 39f1f45262
commit b9ff669748

View file

@ -207,6 +207,12 @@ tar archive several times. Each archive member is represented by a
problems: A directory's modification time is reset each time a file is
created in it. And, if a directory's permissions do not allow writing,
extracting files to it will fail.
\begin{notice}[warning]
Never extract archives from untrusted sources without prior inspection.
It is possible that files are created outside of \var{path}, e.g. members
that have absolute filenames starting with \code{"/"} or filenames with
two dots \code{".."}.
\end{notice}
\versionadded{2.5}
\end{methoddesc}
@ -221,6 +227,10 @@ tar archive several times. Each archive member is represented by a
archive there are some issues you must take care of yourself. See the
description for \method{extractall()} above.
\end{notice}
\begin{notice}[warning]
See the warning for \method{extractall()}.
\end{notice}
\end{methoddesc}
\begin{methoddesc}{extractfile}{member}