git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git archive generates tar with malformed pax extended attribute

From
Jeff King <peff@peff.net>
Date
May 28, 2019, 05:44 UTC
Message-ID
<20190528054434.GA7946@sigill.intra.peff.net>
In-Reply-To
<2b52ca7b-bb72-193a-9d6b-83003ce49424@web.de>
On Sun, May 26, 2019 at 11:33:20PM +0200, René Scharfe wrote:
Show 8 quoted lines
> Git archive writes link targets that are 100 characters long or less
> into the appropriate field in the plain tar header.  It copies
> everything, including NULs, but unlike a PAX extended header that field
> lacks a length indicator, so extractors basically have to treat it as
> NUL-terminated.
> 
> If we want to preserve NUL in short link targets as well, we'd have to
> put such names into an PAX extended header..

I can't say that I care much either way, since putting NULs in your filenames is pretty crazy. But that would at least make things consistent regardless of the length.

I also wondered if you could play any security tricks here (e.g., by having one tool view a filename as "foo" and another as "foo\0bar"). I doubt it, though. Filenames themselves in Git are always NUL-terminated, since that's dictated the tree format; so this is really just about link destinations.

And even then, it's hard to imagine a case. I was wondering if you could have an entry ".git\0foo" that ends up written to the filesystem as ".git". But these are tar archives we're talking about, so it's not like you couldn't just put ".git" in a tar file in the first place.

But maybe somebody else can brainstorm something more evil. :)
-Peff
Previous: René ScharfeNext: Jeff King
Message 9 of 21 in “git archive generates tar with malformed pax extended attribute”
  1. Keegan Carruthers-SmithMay 24, 2019
  2. Jeff KingMay 24, 2019
  3. Keegan Carruthers-SmithMay 24, 2019
  4. Jeff KingMay 24, 2019
  5. René ScharfeMay 25, 2019
  6. Andreas SchwabMay 25, 2019
  7. Ævar Arnfjörð BjarmasonMay 25, 2019
  8. René ScharfeMay 26, 2019
  9. Jeff KingMay 28, 2019
  10. Jeff KingMay 28, 2019
  11. René ScharfeMay 28, 2019
  12. Jeff KingMay 28, 2019
  13. René ScharfeMay 28, 2019
  14. Jeff KingMay 29, 2019
  15. René ScharfeMay 29, 2019
  16. Jeff KingMay 30, 2019
  17. René ScharfeJun 2, 2019
  18. Jeff KingJun 4, 2019
  19. Keegan Carruthers-SmithMay 27, 2019
  20. Ævar Arnfjörð BjarmasonMay 25, 2019
  21. brian m. carlsonMay 25, 2019

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.