ITADN

unzipping an ansolute-path symlink can delete target file

#945Closedpmqs 创建于 2026-01-27
P
pmqscommented
Two issues to report 1. The fix for #936 via bb282ace2281c7734b8537d2b906511e688a5313 has an edge condition that results in the target of a symlink being deleted. 2. The user can sometimes get prompted to write the target of an absolute-path symlink. This may, or may not be an error. The enclosed zip file [symlink.zip](https://github.com/user-attachments/files/24883586/symlink.zip) contains two files * `link_in/` is a symbolic link to `/tmp` ``` $ unzip -p symlink.zip link_in/ /tmp ``` * ` link_in/data` is a plain vanilla file ``` $ unzip -p symlink.zip link_in/data bad data ``` ## Use case 1: No prompting when the target of the symlink does not exist. ```shell # Confirm that the target does not exist $ cat /tmp/data cat: /tmp/data: No such file or directory $ minizip -x -d out symlink.zip minizip-ng 4.1.0 - https://github.com/zlib-ng/minizip-ng --------------------------------------------------- -x -d out symlink.zip Archive symlink.zip Extracting link_in/ Extracting link_in/data Error -107 saving entries to disk symlink.zip ``` and `/tmp/data` doesn't get created as expected. ``` $ cat /tmp/data cat: /tmp/data: No such file or directory ``` That is all fine. ## Use case 2: Prompting when the target of the symlink does exist and target file deleted Create the target file for the symlink ```bash $ echo good data >/tmp/data $ cat /tmp/data good data ``` Now unzip `symlink.zip` ```bash $ minizip -x -d out symlink.zip minizip-ng 4.1.0 - https://github.com/zlib-ng/minizip-ng --------------------------------------------------- -x -d out symlink.zip Archive symlink.zip Extracting link_in/ Extracting link_in/data The file out/link_in/data exists. Overwrite ? [y]es, [n]o, [A]ll: y ``` Note that the user has been prompted to overwrite the target file of the symlink. Not sure if that is the right thing to do. Check what was unzipped The symlink was created ok. ```bash $ file out/link_in out/link_in: symbolic link to /tmp ``` but `/tmp/data` has been deleted. That was not expected. ```bash $ cat /tmp/data cat: /tmp/data: No such file or directory ``` As an aside, I'm in the process of writing a test harness for the [Info-ZIP](https://infozip.sourceforge.net/) executables (zip, unzip etc) and thought I'd use the #936 issue as an example use case to see how the test harness worked with minizip. Worked fine. If there is any interest in a minizip test harness, I'll start a thread on the Discussions board.
关闭于 2026-01-27 1 条评论