현재 최신 버전입니다. · 출시일:
설치 파일 1.3.2
| 아키텍처 | 형식 | 설치 범위 | 파일 크기 | 다운로드 | SHA256 |
|---|---|---|---|---|---|
| 64비트 | ZIP → 포터블 | — | — | github.com | VirusTotal |
링크와 SHA256은 Windows 패키지 관리자 커뮤니티 매니페스트에서 가져왔습니다. 실행하기 전에 다운로드한 파일의 해시를 비교해 보십시오.
릴리스 노트
Security
- Extraction no longer writes through a symbolic link already in the destination. If
out/target.txt was a link to a file elsewhere and the archive carried target.txt, extracting
into out truncated the link's target and wrote the entry's bytes into it, outside the
destination. Every release from 1.0.0 to 1.3.1 did this, in cram x, in streamed extraction and
in cram-extract. An existing path is now overwritten only if it is a regular file; a link, a
FIFO or a device is left as it is and the entry is reported as a failure naming the cause. The
check is made on the opened handle, so there is no window between checking and writing. A
pre-existing FIFO also used to hang the extraction, and now fails the entry instead. The refusal
is tested on Linux; on Windows, where planting the link needs symlink privilege or Developer Mode,
the same test has not yet run. Reported by @anish833.
Still followed, on purpose: a link to a directory above the final component (out/sub -> elsewhere, entry sub/x). Cram never creates a link from an archive, so one inside the
destination was put there by the user or another program.
