remove ..; from sources Reference: /n/atom/patch/applied2013/tarfsnodotdot Date: Thu Oct 3 20:47:38 CES 2013 Signed-off-by: quanstro@quanstro.net --- /sys/src/cmd/tapefs/tarfs.c Thu Oct 3 20:47:23 2013 +++ /sys/src/cmd/tapefs/tarfs.c Thu Oct 3 20:47:24 2013 @@ -144,10 +144,12 @@ } f.mode &= DMDIR | 0777; - /* make file name safe and canonical */ + /* make file name safe, canonical and free of . and .. */ while (fname[0] == '/') /* don't allow absolute paths */ ++fname; cleanname(fname); + while (strncmp(fname, "../", 3) == 0) + fname += 3; /* reject links */ linkflg = hp->linkflag == LF_SYMLINK1 ||