Repository navigation
tar held to the system tar over a rich tree, its extraction fuzzed with hostile archives - #35
Merged
Merged
Conversation
…th hostile archives The README's word for the commands, "the grammar, output and exit statuses of the tool it stands in for", held for tar against the tar on PATH (bsdtar on macOS, GNU tar on Linux) over a tree with the shapes a format has to carry: a path over 100 bytes and one over 255, a non-ASCII name of characters no filesystem renormalizes, a name with spaces, an empty file, an executable, a private file, a symlink, a hard link, an empty directory, a 100 kB file, a fixed mtime on everything. An archive this tar creates extracts under the system tar to the same tree (kinds, permission bits, contents, link targets, mtimes) and the system tar's under this tar, and both list the same names; the same both ways for -z, -J and --zstd, this tar opening the system tar's compressed archives by magic alone (TestContractInteropRichTree, TestContractInteropCompressed; the system tar runs under COPYFILE_DISABLE and a UTF-8 locale, or macOS adds AppleDouble entries and escapes non-ASCII names in its listing). FuzzExtract feeds `tar -xf - -C dest` archive bytes grown from six seeds (a plain file, a symlink out of the tree and a file through it, a `..` name, an absolute name, a hard link out of the tree, a PAX long name) and holds that nothing lands beside or above the destination, nothing panics, and the exit status is 0 or 2. Three minutes with the minimizer off (which stalls on a target that makes directories): no failure. Co-Authored-By: Claude Fable 5.1 <[email protected]> Signed-off-by: closer-claudio <[email protected]>
closer-claudio
enabled auto-merge
October 20, 2026 06:47
Contributor
Author
|
Reviewed at 652dbec |
apostasie
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Why:
tarhad no check against the system tar, so an archive this tar writes that the system cannot read, or the reverse, would go unnoticed; and extraction had no fuzz target against hostile archives.🛠️ What:
internal/tarcmd/contract_interop_test.go(archives written here extracted by the host'sbsdtar,gtarortar, found on the host's own PATH with the hermetic entries removed, and the reverse, compared file by file over long and non-ASCII names, spaces, empty files, modes, symlinks, hard links, empty directories and mtimes;-z,-Jand--zstdby magic and round trip),internal/tarcmd/fuzz_test.go(FuzzExtractwith..components, absolute paths, links out of the tree and PAX long names: extraction stays inside the target and returns without panic).🧪 How:
go test ./...green; three minutes of fuzzing clean with the minimizer off (the target creates directories, which stalls the engine's minimizer, so-fuzzminimizetime=0, as the file says); command mutation sample 29 of 43 killed, the survivors option parsing and mode-bit edges intarcmd,zipandunzip. No defect found.📝 Notes:
-Jand--zstdskip where the host has noxzorzstdoutside the hermetic root; the system tar runs withCOPYFILE_DISABLE=1and a UTF-8 locale so AppleDouble entries and octal-escaped listings stay out of the comparison.