1
0
mirror of https://github.com/golang/go synced 2024-11-26 04:27:58 -07:00
go/src/archive/tar
Damien Neil 7a00f973a5 archive/tar, archive/zip: disable ErrInsecurePath by default
This change is being made late in the release cycle.
Disable it by default. Insecure path checks may be enabled by setting
GODEBUG=tarinsecurepath=0 or GODEBUG=zipinsecurepath=0.
We can enable this by default in Go 1.21 after publicizing the change
more broadly and giving users a chance to adapt to the change.

For #55356.

Change-Id: I549298b3c85d6c8c7fd607c41de1073083f79b1d
Reviewed-on: https://go-review.googlesource.com/c/go/+/452616
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Russ Cox <rsc@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
2022-11-22 18:11:34 +00:00
..
testdata archive/tar: limit size of headers 2022-10-05 20:40:43 +00:00
common.go archive/tar, archive/zip: disable insecure file name checks with GODEBUG 2022-11-21 21:14:38 +00:00
example_test.go
format.go archive/tar: limit size of headers 2022-10-05 20:40:43 +00:00
fuzz_test.go all: add a handful of fuzz targets 2022-01-13 18:06:33 +00:00
reader_test.go archive/tar, archive/zip: disable insecure file name checks with GODEBUG 2022-11-21 21:14:38 +00:00
reader.go archive/tar, archive/zip: disable ErrInsecurePath by default 2022-11-22 18:11:34 +00:00
stat_actime1.go all: go fix -fix=buildtag std cmd (except for bootstrap deps, vendor) 2021-10-28 18:17:57 +00:00
stat_actime2.go all: go fix -fix=buildtag std cmd (except for bootstrap deps, vendor) 2021-10-28 18:17:57 +00:00
stat_unix.go all: use new "unix" build tag where appropriate 2022-03-29 16:24:51 +00:00
strconv_test.go archive/tar: detect out of bounds accesses in PAX records resulting from padded lengths 2021-02-09 05:28:50 +00:00
strconv.go all: gofmt main repo 2022-04-11 16:34:30 +00:00
tar_test.go all: gofmt -w -r 'interface{} -> any' src 2021-12-13 18:45:54 +00:00
writer_test.go archive/tar, archive/zip: return ErrInsecurePath for unsafe paths 2022-11-16 23:36:48 +00:00
writer.go archive/tar: limit size of headers 2022-10-05 20:40:43 +00:00