Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[xaprepare] Make 7zip work with "dangerous" symlinks in ZIPs #8737

Merged
merged 3 commits into from
Feb 21, 2024

Conversation

grendello
Copy link
Contributor

@grendello grendello commented Feb 19, 2024

From time to time, 7zip invoked by xaprepare with an error similar to:

ERROR: Dangerous symbolic link path was ignored : android-ndk-r26c/toolchains/llvm/prebuilt/linux-x86_64/lib/python3.10/site-packages/lldb/lldb-argdumper : ../../../../bin/lldb-argdumper
ERROR: Dangerous symbolic link path was ignored : android-ndk-r26c/toolchains/llvm/prebuilt/linux-x86_64/lib/python3.10/site-packages/lldb/_lldb.cpython-310-x86_64-linux-gnu.so : ../../../liblldb.so

The problem is that this symlink is not a dangerous one, as it doesn't
point outside the archived directory tree.

This happened on mac, Windows and Linux alike.

Try to work around the issue by using an undocumented -snld 7zip option
when extracting ZIP archives. Since the option is understood only from
7-Zip 20.x, check the version before using the argument.

From time to time, `7zip` invoked by `xaprepare` with an error
similar to:

    ERROR: Dangerous symbolic link path was ignored : android-ndk-r26c/toolchains/llvm/prebuilt/linux-x86_64/lib/python3.10/site-packages/lldb/lldb-argdumper : ../../../../bin/lldb-argdumper
    ERROR: Dangerous symbolic link path was ignored : android-ndk-r26c/toolchains/llvm/prebuilt/linux-x86_64/lib/python3.10/site-packages/lldb/_lldb.cpython-310-x86_64-linux-gnu.so : ../../../liblldb.so

The problem is that this symlink is **not** a dangerous one, as it
doesn't point outside the archived directory tree.

This happened on mac, Windows and Linux alike.

Try to work around the issue by using an undocumented `-snld` 7zip
option when extracting ZIP archives.
@jonpryor
Copy link
Member

Looks like our 7z doesn't like it?

[7zip] extracting archive
[7zip] log file: bin/BuildRelease/prepare-20240219T092131.7zip-extract.xamarin-android-toolchain-L_17.0.6-7.1.0.7z.log
stderr | 
stderr | 
stderr | Command Line Error:
stderr | Incorrect switch postfix:
stderr | -snld
Elapsed: 00:00:00.0095147

or we need to specify -snld "elsewhere" on the command-line?

@grendello
Copy link
Contributor Author

Yeah, the version we have doesn't like the d in -snld it seems. I need to work on it a bit, because version detection for 7z doesn't quite work it seems and we need to add the switch based on 7z version. Also, the version we use from nuget doesn't seem to need the switch, it doesn't appear to have the dangerous symlink detection code that trips up the newer versions.

@grendello grendello merged commit 8213348 into main Feb 21, 2024
45 of 47 checks passed
@grendello grendello deleted the dev/grendel/fix-xaprepare-7zip-symlinks branch February 21, 2024 08:38
grendello added a commit that referenced this pull request Feb 21, 2024
* main:
  [xaprepare] Make 7zip work with "dangerous" symlinks in ZIPs (#8737)
grendello added a commit that referenced this pull request Feb 28, 2024
* main:
  Bump to xamarin/xamarin-android-tools/main@37d79c9 (#8752)
  Bump to dotnet/installer@d070660282 9.0.100-preview.3.24126.2 (#8763)
  Bump to xamarin/java.interop/main@14a9470 (#8766)
  $(AndroidPackVersionSuffix)=preview.3; net9 is 34.99.0.preview.3 (#8765)
  [Mono.Android] Do not dispose request content stream in AndroidMessageHandler (#8764)
  Bump com.android.tools:r8 from 8.2.42 to 8.2.47 (#8761)
  [Mono.Android] fix a set of the "easiest" trimmer warnings (#8731)
  Bump to dotnet/installer@0a73f814e1 9.0.100-preview.2.24122.3 (#8716)
  [ci] Always run the MAUI test job (#8750)
  Add a property required by #8478 (#8749)
  [xamarin-android-tools] import $(LibZipSharpVersion) value (#8738)
  Bump to xamarin/Java.Interop/main@c825dcad (#8701)
  Bump to xamarin/monodroid@cb01503327 (#8742)
  Bump to xamarin/Java.Interop/main@ae65609 (#8744)
  Bring in changes from PR #8478 (#8727)
  [xaprepare] Make 7zip work with "dangerous" symlinks in ZIPs (#8737)
  Bump NDK to r26c (#8732)
  Debugging MSBuild Tasks (#8730)
@github-actions github-actions bot locked and limited conversation to collaborators Mar 22, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants