Restore archive extraction between directory symlinks
Commit 03f19aa4ea (cmSystemTools: Fix path traversal vulnerability in
archive extraction, 2026-01-06, v4.3.0-rc1~179^2) incidentally
introduced the `ARCHIVE_EXTRACT_SECURE_SYMLINKS` flag when extracting
archives, which prevents extraction of objects whose location would be
altered by a symlink on disk. However, this particular behavior change
was never documented or tested alongside the other changes in the
commit (absolute paths and path traversal components).
Divergent behavior of this flag from `libarchive` on Windows and
non-Windows platforms needs further investigation. In particular, on
Windows, archives cannot be extracted through directory symlinks, but
can be extracted through junctions. On Linux, archives *can* still be
extracted through symlinks, and archives containing symlinks can be
extracted as well.
The symlink change breaks compatibility with many common use cases of
existing projects, e.g., when extracting an archive inside a symlinked
build directory. Revert the flag until this issue can be explored in a
future version of CMake.
Fixes: #27752
Reported-by: scivision <scivision@users.noreply.github.com>
6 files changed