Re: sharutils: Directory traversal (security issue) in uudecode

On 2022-11-27 07:57, Hanno B=C3=B6ck wrote:

> I want to report a security issue in the uudecode commandline tool that
> is part of sharutils.

POSIX requires the current behavior and it's been that way for ages=20
without actual problems being reported. So one possibility is to merely=20
document the situation.

Another possibility is to do as GNU 'tar' does, and warn about dubious=20
file names starting with '/' or '~', while stripping leading prefixes=20
(including anything ending in ".."), while retaining the current=20
behavior if POSIXLY_CORRECT is set. uudecode could steal tar's code to=20
do that.