extract_tar() allocates archive_read, archive_write_disk, and
archive_match handles, but several early-return error paths did not free
them. Most notably, a PATTERNS entry matching nothing leaked all three
handles on every call, which accumulates inside a long-running
configure.
Scope the three handles with std::unique_ptr custom deleters so every
return path releases them automatically. std::unique_ptr does not
invoke the deleter for a null pointer, and the libarchive *_free
functions are themselves no-ops on null, so no explicit guarding is
required. archive_read_free()/archive_write_free() implicitly close the
handle if needed, matching the previous behavior.
Fixes: #27872
Use `cmake -E create_symlink` or `file(CREATE_LINK)` as appropriate
instead of `ln -sf` on UNIX only to extend cases of (a) symlinks inside
archives and (b) archive extraction to a directory symlink to non-UNIX
platforms where either of these modes may be supported.
The latter relies on the NEW behavior of CMP0205 as it uses
`COPY_ON_ERROR` for platforms where directory symlinks aren't
supported.
Issue: #27756
Commit 03f19aa4ea (cmSystemTools: Fix path traversal vulnerability in
archive extraction, 2026-01-06, v4.3.0-rc1~179^2) incidentally
introduced the `ARCHIVE_EXTRACT_SECURE_SYMLINKS` flag when extracting
archives, which prevents extraction of objects whose location would be
altered by a symlink on disk. However, this particular behavior change
was never documented or tested alongside the other changes in the
commit (absolute paths and path traversal components).
Divergent behavior of this flag from `libarchive` on Windows and
non-Windows platforms needs further investigation. In particular, on
Windows, archives cannot be extracted through directory symlinks, but
can be extracted through junctions. On Linux, archives *can* still be
extracted through symlinks, and archives containing symlinks can be
extracted as well.
The symlink change breaks compatibility with many common use cases of
existing projects, e.g., when extracting an archive inside a symlinked
build directory. Revert the flag until this issue can be explored in a
future version of CMake.
Fixes: #27752
Reported-by: scivision <scivision@users.noreply.github.com>
"Compression format unsupported" errors of this form can only possibly
come from `file(ARCHIVE_CREATE)`, so we don't need to track the line
number of the called function. Reduce the need to update these numbers
every time the test helper script is updated.
Add security flags to libarchive extraction to prevent path traversal
(Zip Slip) and absolute path attacks:
- ARCHIVE_EXTRACT_SECURE_NODOTDOT: Block ".." path components
- ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS: Block absolute paths
- ARCHIVE_EXTRACT_SECURE_SYMLINKS: Block symlinks escaping extract dir
This hardens both `cmake -E tar` and `file(ARCHIVE_EXTRACT)` against
malicious archives that attempt to write files outside the intended
extraction directory.
For policy-specific tests, use the version before the policy was
introduced. Otherwise, use 3.5 where possible.
Also, remove `cmake_minimum_required()` and `project()` calls from
individual cases where they are handled by `CMakeLists.txt`.
This allows the Zstd compression-level to be set between 0-19. I've
adjusted some of the tests, and error messages to indicates the selected
algorithm, and min/max of its compression-level.
Fixes: #24160
The two options were concatenated internally for both ARCHIVE_CREATE
and ARCHIVE_EXTRACT. The distinction between files and dirs was not
meaningful. Therefore, replace them with PATHS or PATTERNS
to more accurately describe the way the options are used.
Fixes: #20884
Daksh Mamodiya
Brad King
Tyler Yankee
AJIOB
Leslie P. Polzer
Hanna Rusakovich
Yuri Witte
Amir Masoud Abdol
Asit Dhal
Craig Scott
Cristian Adam