[PATCH 0/2] fetch2: harden deb/ipk unpack command argument

  Hi,

  This series hardens fetch2 unpack handling in two small, separate steps.

  The first patch fixes deb/ipk unpack handling by selecting the data archive
  member only from the set of supported data member names. This avoids passing
  unsupported ar member names through to the shell command. It also quotes the
  package path used by the deb/ipk unpack command.

  The second patch is separate hardening for the striplevel parameter,
  which is appended to tar arguments before the unpack command is run. It
  validates striplevel as a decimal component count before using it.

  Regression coverage is added to FetcherLocalTest for supported deb/ipk data
  members, unsupported data member names, quoted package filenames, and invalid
  striplevel values.

  Tests run:
      BB_SKIP_NETTESTS=yes bin/bitbake-selftest bb.tests.fetch.FetcherLocalTest


Anders Heimer (2):
  fetch2: validate deb/ipk data member names
  fetch2: validate striplevel parameter

 lib/bb/fetch2/__init__.py | 15 +++++++---
 lib/bb/tests/fetch.py     | 63 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 4 deletions(-)

-- 
2.34.1