starred/sharpcompress
1
0
Fork 0
mirror of https://github.com/adamhathcock/sharpcompress.git synced 2026-09-24 16:05:27 +00:00
Code Issues 975 Packages Projects Releases 25 Wiki Activity

fixes SharpCompress TAR extraction overwrites files outside the extraction root when a SymbolicLinkHandler enables symlink chaining

Browse Source
This commit is contained in:
Adam Hathcock
2026-08-05 13:44:19 +01:00
parent 67bd9289f9
commit 513b6bec45
7 changed files with 475 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/API.md
View File

@@ -463,6 +463,8 @@ using (var archive = ZipArchive.OpenArchive("file.zip"))
`CheckCrc` validates archive-level payload checksums when the format stores reliable metadata, such as ZIP CRC32 values. Formats without payload checksums skip this validation. Decompressor integrity checks that are required to decode a stream may still fail even when `CheckCrc` is disabled.
When using `SymbolicLinkHandler`, directory extraction rejects link targets outside the extraction root and never follows symbolic links or reparse points while extracting later entries. The handler itself remains trusted application code.
### Options matrix
```text