The 'untar()' function in R-devel now prevents file extraction outside the designated directory by validating paths and rejecting unsafe links.

Technology Conflict Programming LanguagesOct 23, 2026score 0.172 posts · 0 replies across 1 instances

The thread discusses recent changes in R-devel bug fixes related to the 'untar()' function, focusing on security improvements such as path validation, link handling, permission settings, and security bits. These changes aim to enhance the safety and reliability of file extraction processes in R.

Claims

Parent: Software SecurityEntity: R-develImpact: positiveDate: Oct 23, 2026 - Oct 24, 2026Target: Security improvements in R-devel's 'untar()' function

Source posts

@[email protected]

Changes in R-devel Bug Fixes:
The internal method of ‘untar()’ now checks the whole path of every member, so that a final component of ‘".."’ or ‘"~"’ can no longer place a link or file outside the extraction directory; rejects hard- and symbolic-link targets restored as file copies, which resolve outside the extraction directory or pass through a symbolic link; applies the umask to extracted files; also no longer restores setuid or setgid permission bits. Similarly,...
https://developer.r-project.org/blosxom.cgi/R-devel/NEWS/2026/10/23

0 boosts · 0 favs · 0 replies · Oct 23, 2026

@[email protected]

Changes in R-devel Bug Fixes:
The internal method of ‘untar()’ now checks the whole path of every member, so that a final component of ‘".."’ or ‘"~"’ can no longer place a link or file outside the extraction directory; rejects hard- and symbolic-link targets restored as file copies, which resolve outside the extraction directory or pass through a symbolic link; applies the ‘umask’ to extracted files; also no longer restores ‘setuid’ or ‘setgid’ permission bits. Simi...
https://developer.r-project.org/blosxom.cgi/R-devel/NEWS/2026/10/24

0 boosts · 0 favs · 0 replies · Oct 24, 2026