4

When you try to unzip a file with relative paths above the working directory (e.g. ../../foo), you get this message:

warning: skipped "../" path component(s) in ../../foo

inflating: foo

The issue is, our software is creating these zips with relative paths during an installation, and if the installation goes wrong, we unzip them to put everything back the way it was. If the user has elected to store some data files "above" the normal installation directory, we end up with ../datafile in the backup. This should be perfectly fine, and we want unzip to trust the archive and put the files back if we ask. Unfortunately, I can't find an option to tell unzip to not worry about the ../ path components and unzip the archive exactly as it was created. Is there an option to unzip to do this?

Note that changing the way the zips are created is not possible at this time, so "Don't do it that way" is not an acceptable answer. We've got to play the hand we've been given. The target platform is RHEL 5.

3

This should do what you're asking for

unzip -: foo.zip

From the man page

-: [all but Acorn, VM/CMS, MVS, Tandem] allows to extract archive members into locations outside of the current '' extraction root folder''. For security reasons, unzip normally removes ''parent dir'' path components (''../'') from the names of extracted file. This safety feature (new for version 5.50) prevents unzip from accidentally writing files to ''sensitive'' areas outside the active extraction folder tree head. The -: option lets unzip switch back to its previous, more liberal behaviour, to allow exact extraction of (older) archives that used ''../'' components to create multiple directory trees at the level of the current extraction folder. This option does not enable writing explicitly to the root directory (''/''). To achieve this, it is necessary to set the extraction target folder to root (e.g. -d / ). However, when the -: option is specified, it is still possible to implicitly write to the root directory by specifiying enough ''../'' path components within the zip archive. Use this option with extreme caution.

  • Perfect! I verified that this does exactly what I'm looking for. – Haydentech Oct 28 '16 at 20:34
  • For the record, I did check the man page... I just missed this. :-) – Haydentech Oct 28 '16 at 20:35
  • @BillHayden I almost missed it too. The non-letter based flags always trip me up. – Zachary Brady Oct 28 '16 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.