unkin/vimpack
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reject path-traversal archive entries and make the install swap cross-filesystem safe #2

Merged
benvin merged 2 commits from benvin/extract-and-swap-fixes into main 2026-09-06 10:46:35 +10:00
Conversation 0 Commits 2 Files Changed 15
+736 -44
unkin-agent commented 2026-09-05 16:33:07 +10:00
Member
Copy Link
Copy Source

M.extract shelled to tar/unzip without inspecting the archive, so a hostile plugin could write outside the destination. Staging also lived on a different filesystem to the install target, so the final rename returned EXDEV and every install failed.

  • Reject archive members that are absolute, escape via .., are device/fifo/socket, or link outside the destination.
  • Stage under <pack root>/.vimpack-stage/ so the swap is a same-filesystem rename; fall back to copy+rename on EXDEV.
  • Propagate build_headers errors from registry.resolve instead of fetching unauthenticated.
  • Reject a dir_name that is not a single path component.
  • Point pipelines at the vimpack-ci service account and install zip.
`M.extract` shelled to `tar`/`unzip` without inspecting the archive, so a hostile plugin could write outside the destination. Staging also lived on a different filesystem to the install target, so the final rename returned EXDEV and every install failed. - Reject archive members that are absolute, escape via `..`, are device/fifo/socket, or link outside the destination. - Stage under `<pack root>/.vimpack-stage/` so the swap is a same-filesystem rename; fall back to copy+rename on EXDEV. - Propagate `build_headers` errors from `registry.resolve` instead of fetching unauthenticated. - Reject a `dir_name` that is not a single path component. - Point pipelines at the `vimpack-ci` service account and install `zip`.
unkin-agent added 1 commit 2026-09-05 16:33:07 +10:00
Validate archive entries and stage inside the pack root
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/lint Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ca55c9dd9f 
- Reject archive members that are absolute, escape via .., are special files, or link outside the destination, before anything is written

- Stage under the pack root so the swap is a same-filesystem rename, with an EXDEV copy fallback; propagate registry auth errors and validate dir_name
unkin-agent added 1 commit 2026-09-05 16:59:27 +10:00
Validate zip symlinks and backslash paths before extraction
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/lint Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
6e1b018adb 
- treat `\` as a separator in safe_relative so `\abs` and `..\..\x` are refused
- read zip symlink targets with `unzip -p` off the `unzip -Z -l` listing and reject escapes before unpacking
benvin merged commit 06781ef4e3 into main 2026-09-06 10:46:35 +10:00
benvin deleted branch benvin/extract-and-swap-fixes 2026-09-06 10:46:36 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/vimpack#2
Delete Branch "benvin/extract-and-swap-fixes"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?