Revert symlink target restrictions added in f942a706#28692
Closed
fmeum wants to merge 1 commit intobazelbuild:masterfrom
Closed
Revert symlink target restrictions added in f942a706#28692fmeum wants to merge 1 commit intobazelbuild:masterfrom
fmeum wants to merge 1 commit intobazelbuild:masterfrom
Conversation
This breaks real use cases (bazelbuild/bazel-worker-api#21) and isn't security relevant as symlinks are created last and the way they are created doesn't itself follow symlinks.
Collaborator
Author
|
@meteorcloudy @meisterT These are the changes we should probably revert (see the linked issue). I won't have time for this today, but we should rewrite the test to simulate a more realistic "symlink attack" by e.g. creating a symlink to some absolute path and then trying to overwrite that file with another file or symlink via the symlink. |
Collaborator
Author
|
@bazel-io fork 9.0.1 |
Collaborator
Author
|
@bazel-io fork 9.1.0 |
This was referenced Feb 17, 2026
mbland
added a commit
to EngFlow-Academy/bzlmod-bootcamp
that referenced
this pull request
Feb 18, 2026
Bumping bazel_worker_api to v0.0.10 resolves bazelbuild/bazel-worker-api#21 (see also bazelbuild/bazel#28692): ```txt ERROR: external/bazel_tools/tools/build_defs/repo/http.bzl:200:45: An error occurred during the fetch of repository 'bazel_worker_api+': Traceback (most recent call last): File "external/bazel_tools/tools/build_defs/repo/http.bzl", line 200, column 45, in _http_archive_impl download_info = ctx.download_and_extract( Error in download_and_extract: java.io.IOException: Error extracting external/bazel_worker_api+/temp685257769505461943/bazel-worker-api-v0.0.6.tar.gz to external/bazel_worker_api+/temp685257769505461943: Tar entries cannot refer to files outside of their directory: external/bazel_worker_api+/temp685257769505461943/bazel-worker-api-v0.0.6.tar.gz has a link bazel-worker-api-0.0.6/proto/.bazelversion pointing to ../.bazelversion ``` Regarding the `test_framework.sh` breakage on macOS, Bazel 9.0.0 flipped `--incompatible_strict_action_env` to `true`. - https://bazel.build/versions/8.5.0/reference/command-line-reference#flag--incompatible_strict_action_env - https://bazel.build/versions/9.0.0/reference/command-line-reference#flag--incompatible_strict_action_env - bazelbuild/bazel#26587 - bazelbuild/bazel@60c5a03 This caused `test_framework.sh` to use `/bin/bash`, instead of any newer Bash on the user's `PATH`. On macOS, `/bin/bash` is version 3.2.57(1)-release, and it failed with an unbound variable error when the `SKIPPED` array was empty: ```txt ../rules_magic+/test/test_framework.sh: line 176: SKIPPED[@]: unbound variable ``` Bash 4.4 fixes the empty array behavior, which is why the error didn't appear earlier while testing with Bash 5 in the `PATH`: - https://cgit.git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?id=3ba697465bc74fab513a26dea700cc82e9f4724e#n878 - https://stackoverflow.com/a/7577209 The workaround was to check the length of `SKIPPED` before expanding it as part of an argument list to a function call.
mbland
added a commit
to EngFlow-Academy/bzlmod-bootcamp
that referenced
this pull request
Feb 18, 2026
Bumping bazel_worker_api to v0.0.10 resolves bazelbuild/bazel-worker-api#21 (see also bazelbuild/bazel#28692): ```txt ERROR: external/bazel_tools/tools/build_defs/repo/http.bzl:200:45: An error occurred during the fetch of repository 'bazel_worker_api+': Traceback (most recent call last): File "external/bazel_tools/tools/build_defs/repo/http.bzl", line 200, column 45, in _http_archive_impl download_info = ctx.download_and_extract( Error in download_and_extract: java.io.IOException: Error extracting external/bazel_worker_api+/temp685257769505461943/bazel-worker-api-v0.0.6.tar.gz to external/bazel_worker_api+/temp685257769505461943: Tar entries cannot refer to files outside of their directory: external/bazel_worker_api+/temp685257769505461943/bazel-worker-api-v0.0.6.tar.gz has a link bazel-worker-api-0.0.6/proto/.bazelversion pointing to ../.bazelversion ``` Regarding the `test_framework.sh` breakage on macOS, Bazel 9.0.0 flipped `--incompatible_strict_action_env` to `true`. - https://github.com/bazelbuild/bazel/releases/tag/9.0.0 - bazelbuild/bazel#26587 - bazelbuild/bazel@60c5a03 - https://bazel.build/versions/9.0.0/reference/command-line-reference#flag--incompatible_strict_action_env - https://bazel.build/versions/8.5.0/reference/command-line-reference#flag--incompatible_strict_action_env This caused `test_framework.sh` to use `/bin/bash`, instead of any newer Bash on the user's `PATH`. On macOS, `/bin/bash` is version 3.2.57(1)-release, and it failed with an unbound variable error when the `SKIPPED` array was empty: ```txt ../rules_magic+/test/test_framework.sh: line 176: SKIPPED[@]: unbound variable ``` Bash 4.4 fixes the empty array behavior, which is why the error didn't appear earlier while testing with Bash 5 in the `PATH`: - https://cgit.git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?id=3ba697465bc74fab513a26dea700cc82e9f4724e#n878 - https://stackoverflow.com/a/7577209 Temporarily setting `--noincompatible_strict_action_env` in `.bazelrc` indeed resolved the error. The permanent workaround is to check the length of `SKIPPED` before expanding it as part of an argument list to a function call.
Member
|
Thanks, but we don't need to fork this issue for 9.0.1 and 9.1.0 as the original change is only available at HEAD and a few rolling releases. |
Collaborator
Author
|
Sorry, didn't see that Mike was this quick of an adopter. :-) |
Member
|
Can you help me understand what the legitimate use of uplink/absolute paths is in tar archives (I don't immediately see it from the linked issue). |
Collaborator
Author
|
Release archives from git repos tend to contain such symlinks for In the linked issue, the up-level reference even stays within the repo. An alternative would be to "sanitize" such symlinks to a target such as |
mbland
added a commit
to EngFlow-Academy/bzlmod-bootcamp
that referenced
this pull request
Feb 18, 2026
Resolves bazelbuild/bazel-worker-api#21 (see also bazelbuild/bazel#28692): ```txt ERROR: external/bazel_tools/tools/build_defs/repo/http.bzl:200:45: An error occurred during the fetch of repository 'bazel_worker_api+': Traceback (most recent call last): File "external/bazel_tools/tools/build_defs/repo/http.bzl", line 200, column 45, in _http_archive_impl download_info = ctx.download_and_extract( Error in download_and_extract: java.io.IOException: Error extracting external/bazel_worker_api+/temp685257769505461943/bazel-worker-api-v0.0.6.tar.gz to external/bazel_worker_api+/temp685257769505461943: Tar entries cannot refer to files outside of their directory: external/bazel_worker_api+/temp685257769505461943/bazel-worker-api-v0.0.6.tar.gz has a link bazel-worker-api-0.0.6/proto/.bazelversion pointing to ../.bazelversion ```
|
Thank you for contributing to the Bazel repository! This pull request has been marked as stale since it has not had any activity in the last 30 days. It will be closed in the next 30 days unless any other activity occurs. If you think this PR is still relevant and should stay open, please post any comment here and the PR will no longer be marked as stale. |
github-actions
Bot
added
the
stale
|
This pull request has been automatically closed due to inactivity. If you're still interested in pursuing this, please post |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation
This breaks real use cases (bazelbuild/bazel-worker-api#21) and isn't security relevant as symlinks are created last and the way they are created doesn't itself follow symlinks.
Build API Changes
No
Checklist
Release Notes
RELNOTES: Symlinks in
.tarfiles can again contain up-level references. Symlinks in.zipfiles can again refer to absolute paths.