Skip to content

add parser for zip #116

@abathur

Description

@abathur

I previously overrode lore for zip from can to cannot because I convinced myself that binlore was just hitting on some code that will try to do something roughly equivalent to system("/bin/rmdir") and I didn't see obvious exec in zip --help.

While working on moving overrides into nixpkgs I noticed that there is actual exec in an argument that isn't included in the --help:

       -TT cmd
       --unzip-command cmd
              Use command cmd instead of 'unzip -tqq' to test an archive when the -T option is used.  On Unix, to use a copy  of  unzip  in  the  current  directory
              instead of the standard system unzip, could use:

               zip archive file1 file2 -T -TT "./unzip -tqq"

              In cmd, {} is replaced by the name of the temporary archive, otherwise the name of the archive is appended to the end of the command.  The return code
              is checked for success (0 on Unix).

As long as the syntax doesn't prove to be a hurdle, I imagine zip is common enough that resholve should carry a parser for it.

(The main justification for carrying this is to remove the lore override and let it be honest. I don't think this option is actually used much in the wild. I struggled to find a real example in wild Shell that wasn't just demonstrating how to use this feature to escalate to root if zip has passwordless sudo.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions