mbox series

[0/2] fetch2: harden deb/ipk unpack command argument

Message ID 20260518145909.1132755-1-anders.heimer@est.tech
Headers show
Series fetch2: harden deb/ipk unpack command argument | expand

Message

Anders Heimer May 18, 2026, 2:59 p.m. UTC 
Hi,

  This series hardens fetch2 unpack handling in two small, separate steps.

  The first patch fixes deb/ipk unpack handling by selecting the data archive
  member only from the set of supported data member names. This avoids passing
  unsupported ar member names through to the shell command. It also quotes the
  package path used by the deb/ipk unpack command.

  The second patch is separate hardening for the striplevel parameter,
  which is appended to tar arguments before the unpack command is run. It
  validates striplevel as a decimal component count before using it.

  Regression coverage is added to FetcherLocalTest for supported deb/ipk data
  members, unsupported data member names, quoted package filenames, and invalid
  striplevel values.

  Tests run:
      BB_SKIP_NETTESTS=yes bin/bitbake-selftest bb.tests.fetch.FetcherLocalTest


Anders Heimer (2):
  fetch2: validate deb/ipk data member names
  fetch2: validate striplevel parameter

 lib/bb/fetch2/__init__.py | 15 +++++++---
 lib/bb/tests/fetch.py     | 63 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 4 deletions(-)