Re: Add ar --output

[Fangrui Song <i at maskray dot me>]

On 2019-10-29, Nick Clifton wrote:
> > There is a proposal https://reviews.llvm.org/D69418 that adds --output
> > to llvm-ar. --output specifies the output directory for the x (extract)
> > operation.
>
> I have started working on an implementation of this feature for the binutils
> version of ar.  I have run across one issue however, which I would like to
> run by you:
>
>   https://sourceware.org/bugzilla/show_bug.cgi?id=17533#c7
>
> Currently the binutils version of ar checks that files are extracted into
> the current directory, or into sub-directories of the current directory,
> but not elsewhere in the file system.  Do you think that the code handling
> the --output option should just waive these checks, on the assumption that
> the if the user wants to extract the files into another place then they
> should know what they are doing, or issue a warning if the resolved path
> would be outside of the current directory, or refuse to create such files ?

I think that the --output option should keep the is_valid_archive_path
check.

1) absolute paths should still be rejected with --output
2) a path component .. can still cause directory traversal problems with
  --output, so it should be rejected as well.

I sent a patch a few days ago:
https://sourceware.org/ml/binutils/2019-10/msg00193.html (both absolute
paths and paths containing .. are rejected) but it may be better for a
maintainer to implement it because I know little about the ar.c code and
may miss something...