Solved
After interesting/insightful inputs from different users, here are the takeaways:
- It doesn't have some critical or dangerous impact or implications when extracted
- It contains the tared parent folder (see below for some neat tricks)
- It only overwrites the owner/permission if
./itself is included in the tar file as a directory. - Tarbombs are specially crafted tar archives with absolute paths
/(by default (GNU) tar strips absolute paths and will throw a warning except if used with a special option–absolute-names or -P) - Interesting read: Path-traversal vulnerability (
../)
Some neat trick I learned from the post
Temporarily created subshell with its own environment:
Let’s say you’re in the home directory that’s called /home/joe. You could go something like:
> (cd bin && pwd) && pwd
/home/joe/bin
/home/joe
Exclude parent folder and ./ ./file from tar
There are probably a lot of different ways to achieve that expected goal:
(cd mydir/ && tar -czvf mydir.tgz *)
find mydir/ -printf "%P\n" | tar -czf mytar.tgz --no-recursion -C mydir/ -T -
source
~~The absolute path could overwrite my directory structure (tarbomb) source Will overwrite permission/owner to the current directory if extracted. source~~
I'm sorry if my question wasn't clear enough, I'm really doing my best to be as comprehensible as possible :/
Hi everyone !
I'm playing a bit around with tar to understand how it works under the hood. While poking around and searching through the web I couldn't find an actual answer, on what are the implication of ./ and ./file structure in the tar archive.
Output 1
sudo find ./testar -maxdepth 1 -type d,f -printf "%P\n" | sudo tar -czvf ./xtractar/tar1/testbackup1.tgz -C ./testar -T -
#output
> tar tf tar1/testbackup1.tgz
text.tz
test
my
file.txt
.testzero
test01/
test01/never.xml
test01/file.exe
test01/file.tar
test01/files
test01/.testfiles
My test folder.txt
Output 2
sudo find ./testar -maxdepth 1 -type d,f | sudo tar -czvf ./xtractar/tar2/testbackup2.tgz -C ./testar -T -
#output
>tar tf tar2/testbackup2.tgz
./testar/
./testar/text.tz
./testar/test
./testar/my
./testar/file.txt
./testar/.testzero
./testar/test01/
./testar/test01/never.xml
./testar/test01/file.exe
./testar/test01/file.tar
./testar/test01/files
./testar/test01/.testfiles
./testar/My test folder.txt
./testar/text.tz
./testar/test
./testar/my
./testar/file.txt
./testar/.testzero
./testar/test01/
./testar/test01/never.xml
./testar/test01/file.exe
./testar/test01/file.tar
./testar/test01/files
./testar/test01/.testfiles
./testar/My test folder.txt
The outputs are clearly different and if I extract them both the only difference I see is that the second outputs the parent folder. But reading here and here this is not a good solution? But nobody actually says why?
Has anyone a good explanation why the second way is bad practice? Or not recommended?
Thank you :)
Yeah but that doesn't answer my question: What's the implication of
./in the tar file? I mean when I extract them, both seem similar but most people say it's bad practice or not recommended but why?I know and do understand how to achieve both with and without the root folder.
Actually it's a bad practice called the tar bomb.
Thank you, I think this is a good lead, but couldn't find a lot of information about it. But the general gist is that it could overwrite my folder structure and mess up the filesystem (source). All sources I found are very old, does that mean that there's some kind of protection today?
I also found out that it will extract the permission and owner to the current directory :/ so this a very odd behavior... (source).
Thank you for your answer !
I doubt there's a perfect protection. Maybe some tar implementations asks confirmation before tar-bombing, but it then wouldn't work for non-interactive sessions, etc.
tar overwrites permissions because tar was meant for archiving iirc. Although, there might be a command line option to change its behavior.
Perhaps, the zip command is better for your purpose. It doesn't allow zip-bombs and perhaps doesn't overwrite permission.