Skip to content

Replace hex_erl_tar fork with OTP master's erl_tar#165

Merged
ericmj merged 3 commits into
mainfrom
ericmj/replace-erl-tar-fork
Mar 8, 2026
Merged

Replace hex_erl_tar fork with OTP master's erl_tar#165
ericmj merged 3 commits into
mainfrom
ericmj/replace-erl-tar-fork

Conversation

@ericmj

@ericmj ericmj commented Mar 7, 2026

Copy link
Copy Markdown
Member

Copy erl_tar.erl and erl_tar.hrl from OTP commit 013041bd68c2 with
minimal modifications (module rename, include path, remove -doc/-moduledoc
attributes for OTP 24 compatibility).

This eliminates divergence from upstream. The fork's add/5 is replaced
with OTP's add/4 using the {mode, Mode} option. hex_filename.erl is
removed since filelib:safe_relative_path/2 is available since OTP 23.

ericmj added 2 commits March 7, 2026 13:21
Copy erl_tar.erl and erl_tar.hrl from OTP commit 013041bd68c2 with
minimal modifications (module rename, include path, remove -doc/-moduledoc
attributes for OTP 24 compatibility).

This eliminates divergence from upstream. The fork's add/5 is replaced
with OTP's add/4 using the {mode, Mode} option. hex_filename.erl is
removed since filelib:safe_relative_path/2 is available since OTP 23.
Join symlink targets with the symlink's parent directory before
validating. Previously the raw target was validated in isolation,
causing safe symlinks like dir/link -> ../file to be incorrectly
rejected as unsafe.
@ericmj

ericmj commented Mar 7, 2026

Copy link
Copy Markdown
Member Author

See erlang/otp#10814 for the backport of "Fix erl_tar rejecting safe symlinks with .. in target"

@ericmj ericmj merged commit 961730b into main Mar 8, 2026
10 checks passed
@ericmj ericmj deleted the ericmj/replace-erl-tar-fork branch March 8, 2026 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant