util::archive_check_paths (private)

 util::archive_check_paths -archive archive

Defined in packages/acs-tcl/tcl/utilities-procs.tcl

Validate entry names of an archive: reject path traversal and absolute paths. Rejects: - Unix absolute paths: names starting with '/' - Windows UNC paths: '\\server\share\...' - Windows drive-letter paths: 'C:\foo', 'D:/bar' - Any path with '..' as a path component (both '/' and '\' separators)

Switches:

-archive (required)

Testcases:

No testcase defined.

Source code:

    set names [util::archive_list_entries -archive $archive]

    foreach name $names {
        set name [string trim $name]
        if {$name eq ""} {
            continue
        }

        # Reject Unix absolute paths: "/foo/bar"
        if {[string index $name 0] eq "/"} {
            error "Archive '$archive' contains an absolute path '$name', which is not allowed."
        }

        # Reject Windows UNC paths: "\\server\share"
        if {[string match {\\\\*} $name]} {
            error "Archive '$archive' contains a UNC-style path '$name', which is not allowed."
        }

        # Reject Windows drive-letter paths: "C:\foo" or "D:/bar"
        if {[regexp {^[A-Za-z]:[\\/]} $name]} {
            error "Archive '$archive' contains a Windows absolute path '$name', which is not allowed."
        }

        # Reject ".." path components.
        if {[regexp {(?:^|[\\/])\.\.(?:$|[\\/])} $name]} {
            error "Archive '$archive' contains a path with '..' components ('$name'), which is not allowed."
        }
    }

XQL Not present:

PostgreSQL, Oracle

Generic XQL file:

packages/acs-tcl/tcl/utilities-procs.xql