astral-sh / astral-sh/tar-codec

Leading-NUL ordinary numeric metadata is rejected

Open
#56 1 comment 0 reactions 0 assignees View on GitHub
diff:restrictive
Dominant language
Rust
Stars
9
Forks
3
Avg merge
9m
Merged PRs (30d)
3

Description

## Summary

`tar-framing` rejects ordinary-header octal metadata when NUL padding appears
before the digits.

The [reproduction archive](https://gist.githubusercontent.com/zaniebot/88e6b0a9b7e9376324cd3357098e5e40/raw/6399c074efaa58541a60291ef1e243ddc5981b63/TC-C16.tar) places a leading NUL in the `uid` field.
It is accepted by Rust `tar`, Tokio TAR, CPython `tarfile`, Go `archive/tar`,
and JavaScript `tar-stream`; all five expose the same empty regular member named
`file`.

Tested with tar-codec revision
`1ac1199559a1b96f0f953ac99520ccc296503808`.

## Observed behavior

The eight-byte `uid` field is `[0, 48, 48, 48, 48, 48, 48, 0]`. The archive is
rejected with `invalid tar uid field` before the member is returned.

## Expected behavior

Consider permitting leading NUL padding before octal digits in ordinary
numeric metadata fields.

If a leading NUL intentionally terminates the field immediately, it would be
useful to document the compatibility difference.

## Impact

This is an interoperability issue, not an extraction vulnerability. The same
five-peer differential is observable for `mode`, `gid`, and `mtime`.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the rejection with the linked TC-C16.tar archive against tar-codec revision 1ac1199559a1b96f0f953ac99520ccc296503808. Inspect the numeric metadata parsing path for uid, then compare the same leading-NUL behavior for mode, gid, and mtime. Done means the compatibility behavior is corrected or explicitly documented, with regression coverage for the affected fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.