[SOLVED] Ignoring command Archive contains files with absolute path

Web-UI
1

I have been using MineOS for some time now but recently, last several months, every time I try to use the Create Server from Archive function it has failed with the above error.

This happens with servers created from different packs from different sources using either 7zip or the Windows zip function on different installs of windows. The only common factor is MineOS.

I am able to create the server using the other standard method but would really like to understand why I can no longer get this feature to work as I had used it many times before without issue.

2

The error indicates that there are files inside the archive which are designated to be placed outside the server directory. Consider the following example archive:

./server.properties
./world
./logs
/usr/bin/tar

As the archive is extracted, if it extracts the “tar” binary, it could cause damage–or be malicious. Minecraft NEVER needs files outside its directory, which is why this error is cropping up for you.

Minecraft isn’t making any guesses about whether the file is malicious, it just knows that a server directory shouldn’t be absolutely pathed. The following would also fail to be recognized in the minecraft file structure

/home/servers/myserver
/home/servers/myserver/server.properties

If the files won’t be extracted in the expected directory, it’ll be overlooked by the webui–so again, absolute file paths in archives are no good: they’ll have to be reformed with relative paths only.

3

Whilst I understand what the error means, I do not understand why it is suddenly happening on every archive I create when this wasn’t formerly the case.

I am creating the archives in Windows but do have access to a Linux environment. Is there any way to find where these absolute paths are?

4

Try out this page, and choose the command corresponding to the actual file extension you’re creating, whether tar, tar.gz, or bz2, etc.: http://www.cyberciti.biz/faq/list-the-contents-of-a-tar-or-targz-file/

5

So looking at the listed contents, every line looks like this:

drwxrwxrwx 0/0 0 2015-03-23 08:31 SkyFactory_223/
drwxrwxrwx 0/0 0 2015-03-22 12:38 SkyFactory_223/asm/
drwxrwxrwx 0/0 0 2015-03-22 12:40 SkyFactory_223/asm/ccl_modular/
-rwxrwxrwx 0/0 10329 2015-03-22 12:40 SkyFactory_223/asm/ccl_modular/aaf.txt

etc.

SkyFactory_223 being the name of the archive. I presume this is as expected? There are no lines showing a path any differently.

6

Here is the logic in the Python code:

if any(f for f in members_ if f.startswith('/') or '..' in f):
    raise RuntimeError(...)

Somewhere in your archive is a file that starts with ‘/’ or has ‘…’ somewhere in the file path (which would allow unintended traversal up the directory tree.)

7

Excellent stuff.

It was a … in a filename that is included as part of the Hats mod.

Thanks for your help.