Gnu tar happily connects to remote hosts, depending on filename
2 comments
It doesn't look particularly dangerous, but it could be irritating if your filename has a colon character in it.
Still, I never heard of this usage of tar before, and I routinely manage several score linux servers. Pretty surprising.
In what way? I mean to say that I could probably think of something, but do you have some specific danger in mind?
The colon's a legal character in Unix filenames, so it's possible someone could send you a file named somehostname:foo.tar and convince you to run tar on it. Of course, if you quote the filename or escape the \:, as bash autocompletion would do, it wouldn't be an issue, but I could imagine some possible scenario.
Apparently the ":" in the filename tells tar to connect to "wtf" using the "rsh" command (aliased to "ssh").
There is no mention of this in the man page: http://linuxcommand.org/lc3_man_pages/tar1.html ; apart from the rather surprising --rsh-command and --rmt-command options.
This actually is documented in the "info" pages:
http://www.gnu.org/software/tar/manual/tar.html#SEC152 :
Isn't it dangerous that a random filename could trigger "tar" to connect to remote hosts ?