Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add parser for zip #116

Open
abathur opened this issue Apr 5, 2024 · 0 comments
Open

add parser for zip #116

abathur opened this issue Apr 5, 2024 · 0 comments

Comments

@abathur
Copy link
Owner

abathur commented Apr 5, 2024

I previously overrode lore for zip from can to cannot because I convinced myself that binlore was just hitting on some code that will try to do something roughly equivalent to system("/bin/rmdir") and I didn't see obvious exec in zip --help.

While working on moving overrides into nixpkgs I noticed that there is actual exec in an argument that isn't included in the --help:

       -TT cmd
       --unzip-command cmd
              Use command cmd instead of 'unzip -tqq' to test an archive when the -T option is used.  On Unix, to use a copy  of  unzip  in  the  current  directory
              instead of the standard system unzip, could use:

               zip archive file1 file2 -T -TT "./unzip -tqq"

              In cmd, {} is replaced by the name of the temporary archive, otherwise the name of the archive is appended to the end of the command.  The return code
              is checked for success (0 on Unix).

As long as the syntax doesn't prove to be a hurdle, I imagine zip is common enough that resholve should carry a parser for it.

(The main justification for carrying this is to remove the lore override and let it be honest. I don't think this option is actually used much in the wild. I struggled to find a real example in wild Shell that wasn't just demonstrating how to use this feature to escalate to root if zip has passwordless sudo.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant