Add a small 7z fixture whose filter chain is ARM64 BCJ followed by
LZMA2. This exercises extraction through CMake's bundled libarchive
and liblzma path.
The fixture was generated with 7-Zip 25.01 (arm64). The payload is a
16-byte AArch64 instruction sequence:
1f2003d500000094000000141f2003d5
The payload mtime was set to 2026-06-21T00:00:00Z and then archived
with:
7z a -m0=ARM64 -m1=LZMA2 -mb0:1 -mtm=on -mtc=off -mta=off \
7zip-arm64-bcj.7z payload.bin
The resulting 7zip-arm64-bcj.7z has SHA256:
3DE9111E71C6AA3CBD604460040EBBE6F57E8B00D1D5C5343AC07D435AA2A8D2
Use `cmake -E create_symlink` or `file(CREATE_LINK)` as appropriate
instead of `ln -sf` on UNIX only to extend cases of (a) symlinks inside
archives and (b) archive extraction to a directory symlink to non-UNIX
platforms where either of these modes may be supported.
The latter relies on the NEW behavior of CMP0205 as it uses
`COPY_ON_ERROR` for platforms where directory symlinks aren't
supported.
Issue: #27756
Commit 03f19aa4ea (cmSystemTools: Fix path traversal vulnerability in
archive extraction, 2026-01-06, v4.3.0-rc1~179^2) incidentally
introduced the `ARCHIVE_EXTRACT_SECURE_SYMLINKS` flag when extracting
archives, which prevents extraction of objects whose location would be
altered by a symlink on disk. However, this particular behavior change
was never documented or tested alongside the other changes in the
commit (absolute paths and path traversal components).
Divergent behavior of this flag from `libarchive` on Windows and
non-Windows platforms needs further investigation. In particular, on
Windows, archives cannot be extracted through directory symlinks, but
can be extracted through junctions. On Linux, archives *can* still be
extracted through symlinks, and archives containing symlinks can be
extracted as well.
The symlink change breaks compatibility with many common use cases of
existing projects, e.g., when extracting an archive inside a symlinked
build directory. Revert the flag until this issue can be explored in a
future version of CMake.
Fixes: #27752
Reported-by: scivision <scivision@users.noreply.github.com>
Add security flags to libarchive extraction to prevent path traversal
(Zip Slip) and absolute path attacks:
- ARCHIVE_EXTRACT_SECURE_NODOTDOT: Block ".." path components
- ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS: Block absolute paths
- ARCHIVE_EXTRACT_SECURE_SYMLINKS: Block symlinks escaping extract dir
This hardens both `cmake -E tar` and `file(ARCHIVE_EXTRACT)` against
malicious archives that attempt to write files outside the intended
extraction directory.
For policy-specific tests, use the version before the policy was
introduced. Otherwise, use 3.5 where possible.
Also, remove `cmake_minimum_required()` and `project()` calls from
individual cases where they are handled by `CMakeLists.txt`.
Similar to GNU tar add a --touch option to the tar extract command to
skip extracting the timestamps from the files in the archive
effectively touching them as if they were just created.
Issue: #22746
Rationale:
Currently during creation of archive by 'tar',
if error appears, it interrupt archive creation.
As a result only part of files are archived
This behaviour is not consistent with 'copy_directory', native 'tar'
and other command behaviour.
With this Merge Request this behaviour is fixed.
NihilDigit
Brad King
Tyler Yankee
Alex Overchenko
Leslie P. Polzer
Kasper Laudrup
Bartosz Kosiorek
Bartosz Kosiorek
Nils Gladitz