Commit Graph

2 Commits (e2c6e6511b1172f4b0d09132c8c53a176bb77394)

Author SHA1 Message Date
Sloane Hertel 080c3ce90c
Targeted fix for installing roles with symlinks containing '..' (#82165) (#82325)
Set the tarfile attribute to a normalized value from unfrackpath instead
of validating path parts and omiting potentially invald parts

Allow tarfile paths/links containing '..', '$', '~' as long as the
normalized realpath is in the tarfile's role directory

(cherry picked from commit 3a42a00368)
2 years ago
Matt Martz 6809f986fc
[stable-2.14] Prevent roles from using symlinks to overwrite files outside of the installation directory (#81780) (#81786)
* Sanitize linkname during role installs

* Add tests

* add clog frag.
(cherry picked from commit ddf0311c63)
2 years ago