Overview
--------

This repository provides samples of archive files in various formats
that attempt to exploit (hypothetical) directory traversal bugs:

.. automatically generated by .private/update-readme

* Leading slash::

     -rw-r--r--  /tmp/moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.7z>`__
  `ar <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.a>`__
  `arc <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.arc>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.arj>`__
  `cab <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.cab>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.zip>`__
  `zoo <https://github.com/jwilk/traversal-archives/releases/download/0/absolute1.zoo>`__

* Multiple leading slashes::

     -rw-r--r--  //tmp/moo

  `ar <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.a>`__
  `arc <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.arc>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.arj>`__
  `cab <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.cab>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.zip>`__
  `zoo <https://github.com/jwilk/traversal-archives/releases/download/0/absolute2.zoo>`__

* Leading dot-dot::

     -rw-r--r--  ../moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.7z>`__
  `ar <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.a>`__
  `arc <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.arc>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.arj>`__
  `cab <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.cab>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.zip>`__
  `zoo <https://github.com/jwilk/traversal-archives/releases/download/0/relative0.zoo>`__

* Non-leading dot-dot::

     -rw-r--r--  tmp/../../moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.7z>`__
  `ar <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.a>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.arj>`__
  `cab <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.cab>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.zip>`__
  `zoo <https://github.com/jwilk/traversal-archives/releases/download/0/relative2.zoo>`__

* File symlink::

     lrwxrwxrwx  moo -> /tmp/moo
     -rw-r--r--  moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/symlink.7z>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/symlink.arj>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/symlink.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/symlink.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/symlink.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/symlink.zip>`__

* Directory symlink::

     lrwxrwxrwx  tmp -> /tmp
     -rw-r--r--  tmp/moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.7z>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.arj>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.zip>`__

* Two directory symlinks (variant A)::

     lrwxrwxrwx  cur -> .
     lrwxrwxrwx  par -> cur/..
     -rw-r--r--  par/moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.7z>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.arj>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.zip>`__

* Two directory symlinks (variant B)::

     lrwxrwxrwx  cur -> .
     lrwxrwxrwx  cur/par -> ..
     -rw-r--r--  par/moo

  `7zip <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.7z>`__
  `arj <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.arj>`__
  `cpio <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.cpio>`__
  `rar <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.rar>`__
  `tar <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.tar>`__
  `zip <https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.zip>`__

.. end of generated stuff

Found bugs
----------

The samples helped find the following bugs:

* ARJ:

  - https://bugs.debian.org/774434 [CVE-2015-0556]
  - https://bugs.debian.org/774435 [CVE-2015-0557]
  - https://bugs.debian.org/867520

* Zoo:

  - https://bugs.debian.org/774453

* ARC:

  - https://bugs.debian.org/774527 [CVE-2015-9275]

* gcab:

  - https://bugs.debian.org/774580 [CVE-2015-0552]

* UnRAR:

  - https://www.openwall.com/lists/oss-security/2017/08/14/3 [CVE-2017-12938]

* Perl (Archive::Tar):

  - https://bugs.debian.org/900834 [CVE-2018-12015]

* GNOME Nautilus:

  - https://bugs.debian.org/878012

* Ark:

  - https://bugs.debian.org/878269

* archiver:

  - https://github.com/mholt/archiver/issues/69

.. vim:ts=3 sts=3 sw=3 et ft=rst