<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-size:small"><span style="color: rgb(32, 33, 34); font-family: sans-serif; font-size: 14px;" class="">So I have been compiling a list of dangerous file paths.</span></div><div class="gmail_default" style="font-size:small"><span style="color:rgb(32,33,34);font-family:sans-serif;font-size:14px" class=""><br class=""></span></div><div class="gmail_default" style="font-size:small"><span style="color:rgb(32,33,34);font-family:sans-serif;font-size:14px" class="">~<anything></span></div><div class="gmail_default" style="font-size:small"><span style="color:rgb(32,33,34);font-family:sans-serif;font-size:14px" class="">/</span><anything></div><div class="gmail_default" style="font-size:small">\<anything></div><div class="gmail_default" style="font-size:small">a:<anything></div><div class="gmail_default" style="font-size:small"><anything>/../<anything><br class=""></div><div class="gmail_default" style="font-size:small">../<anything></div><div class="gmail_default" style="font-size:small"><anything>/..<br class=""></div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small">Any I am missing? The plan here is to ban these for the format itself so these are prohibited on Windows and Linux and OSX.</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></blockquote>Ah, blacklists. Always an issue.</div><div><br class=""></div><div>Concerning your list as it is so far:</div><div><br class=""></div><div>- ~ isn't a feature of the file system, it's a shell expansion. You don't need to worry about it on any system I know of - as long as you are sure you never put one of the filenames in the archive on a shell command line. But then again, if you allow that you've opened the doors of hell anyway.</div><div>- Forbidding leading / and \ - as well as, not A:<anything> but likely</div><div><anything>:<anything> - just says "relative paths only".</div><div>- Yes, you need to forbid upward traversals - i.e., the ".." rules.</div><div>- You should probably forbid following soft links when restoring. There are ways to trick people into creating a soft link to a sensitive directory, and then (perhaps much) later getting them to open an archive that uses that link.</div><div><div>- But ... I can do a lot of mischief by simply overwriting .login or .bash or many other such files. Only works when unarchiving in the login directory - but (a) that's likely pretty common; (b) there may be similar "hazardous" files that appear elsewhere, though they are less common.</div><div>- Consider forbidding the creation files marked executable. Many people include "." in their PATH - and even if they don't there are likely some common places where executables live (e.g., in ~/bin).</div><div><br class=""></div><div>I'm sure with some thought one can find other attacks - especially when you want to support a variety of OS's each with their own quirks. This is why blacklists are always so problematic.</div><div class=""><br class=""></div></div><div class="">Jon Callas's suggestion of always forcing the creation of a subdirectory and then unarchiving into it simplifies things considerably. Perhaps less convenient, but safer. And if you make it a chroot jail, the OS will enforce the inability to escape and you don't need to worry about .. in paths or all kinds of other stuff. But I don't know what the analogue would be in Windows.</div><div class=""><br class=""></div><div class=""><div class=""> -- Jerry</div></div><div class=""><br class=""></div></body></html>