cmd/txtar: extract only in current dir by default

Change the behavior of txtar so that files are extracted only in the
current directory, or a subdirectory of the current directory, by
default.

If the archive contains a path outside the current directory, txtar will
print an error message and quit with exit code 1. It will not extract
any files in this case. This also applies if an environment variable
used in the archive expands into a path outside the current directory.

Add flag -unsafe to remove the restriction and allow extracting files
outside the current dir.

Updates golang/go#46741

Change-Id: Ic12fb8286c5f2a930addd82dcfce196d4a04054c
Reviewed-on: https://go-review.googlesource.com/c/exp/+/371274
Trust: Cherry Mui <cherryyz@google.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
Trust: Bryan Mills <bcmills@google.com>
Run-TryBot: Bryan Mills <bcmills@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
2 files changed
tree: 7fe2e8734c6f44da2be6e3b46bc63657a2263e83
  1. apidiff/
  2. cmd/
  3. ebnf/
  4. ebnflint/
  5. errors/
  6. event/
  7. fsnotify/
  8. inotify/
  9. internal/
  10. io/
  11. jsonrpc2/
  12. maps/
  13. mmap/
  14. rand/
  15. shiny/
  16. shootout/
  17. slices/
  18. sumdb/
  19. utf8string/
  20. vulncheck/
  21. vulndb/
  22. winfsnotify/
  23. .gitattributes
  24. .gitignore
  25. AUTHORS
  26. codereview.cfg
  27. CONTRIBUTING.md
  28. CONTRIBUTORS
  29. go.mod
  30. go.sum
  31. LICENSE
  32. PATENTS
  33. README.md
README.md

exp

PkgGoDev

This subrepository holds experimental and deprecated (in the old directory) packages.

The idea for this subrepository originated as the pkg/exp directory of the main repository, but its presence there made it unavailable to users of the binary downloads of the Go installation. The subrepository has therefore been created to make it possible to go get these packages.

Warning: Packages here are experimental and unreliable. Some may one day be promoted to the main repository or other subrepository, or they may be modified arbitrarily or even disappear altogether.

In short, code in this subrepository is not subject to the Go 1 compatibility promise. (No subrepo is, but the promise is even more likely to be violated by go.exp than the others.)

Caveat emptor.