Skip to content

fix: Decompression write through symlink - #1084

Open
valoq wants to merge 5 commits into
ouch-org:mainfrom
valoq:bugfix
Open

valoq wants to merge 5 commits into
ouch-org:mainfrom
valoq:bugfix

Conversation

@valoq

@valoq valoq commented Sep 20, 2026 •

Copy link
Copy Markdown
Collaborator

If a symbolic link already sits in the folder you unpack into and it has the same name as something the archive unpacks, ouch follows that link. The files are written where the link points instead, and anything already there is overwritten.

This is another case of writing outside the specified directories.
The Landlock sandbox blocks this on Linux, but on On macOS, on Windows it could potentially be exploited.
The only way I see to exploit this, would be to trick a user to extract an archive twice.

This also fixes a few additional issues found along the way.

  • the dialog for the file conflict during extraction showed the compression prompt instead of decompression, missing the merge option.
  • rar archives did not count extracted folders in the number of unpacked files
  • tar symlink and hard link entries failed with "file exists" instead of showing the conflict dialog

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant