Show HN: Tar-minefield shows where tar implementations disagree

Category: security

Tags: tar, security, test-suite, file-format, parsing

Score: 7.3/10 (Innovation: 7, Technical: 6, Documentation: 9, Utility: 7)

Tar-minefield is a test suite and documentation project that catalogs ambiguities in the tar file format and how 20+ implementations handle them differently, exposing security risks in archive extraction. It proposes a strict parsing policy that rejects ambiguous tar files while still accepting 99.77% of real-world source tarballs, making it a valuable reference for tar implementers and security scanners.

Target audience: security engineers, library maintainers, devops

Repository: https://stoppels.ch/tar/ · Python · MIT · 3 stars

View on Hacker News