Security considerations
- Collision resistance. Block identity, deduplication, and pack verification all reduce to the store's multihash function. A hash-collision attack maps directly to content substitution. SHA2-256 (the default) is currently believed collision-resistant; stores choosing another registered multihash function (§10.4) assume that function's security.
- Hostile input. The complete hardening surface is §13.2. The notable
attack classes it closes:
- allocation bombs via declared lengths (CBOR collection caps, the CAR header-frame and section-size caps — a CAR header is an unbounded attacker-declared root list, and unbounded header/section reads are a known CVE class in CAR consumers, cf. advisory GHSA-9x4h-8wgm-8xfg);
- stack exhaustion via deep nesting (depth caps, iterative traversal);
- fetch amplification via fan/diamond DAGs (work bounds);
- cycle non-termination (visited sets);
- name-identity confusion via malformed UTF-8 (fatal decoding);
- block-content substitution in packs (hash verification);
- prototype pollution (inert map keys);
- TOCTOU via buffer aliasing (mandatory copies).
- Ref smuggling and second encodings. Everything §4 rejects at ref parse time closes an attack or an aliasing channel. An identity multihash carries attacker-chosen data inside the ref itself — unbounded, exempt from hash verification and block-size accounting, and a recurring trouble spot in CAR-consuming ecosystems. CIDv0 and non-minimal varints would give one block a second accepted reference spelling, splitting dedupe sets and visited sets. An unsupported codec hides a subgraph of unknown shape (garbage collection fails closed on it, §15.2).
- Duplicate pack sections are legal CARv1; imports absorb them idempotently with enforced byte-equality (§12.4) — under an unverified import, the mandatory byte-compare is what stops a later duplicate from silently rebinding a key to different bytes.
- Non-canonical pack headers (wrong key order, extra fields, non-minimal heads) MUST be rejected (§12.1). A second header encoding is a second byte form for the same pack, and anything that signs, caches, or dedupes packs by their bytes can be split by it.
- CARv2 indexes are unverified derived data. An importer that unwraps CARv2 (§12.5) MUST NOT let the embedded index steer or replace hash verification, closure verification, or section parsing — a hostile index is just a hostile map of offsets.
- Store substitution. A key–value store is not trusted to return the bytes its key names; the fetch-verification rule (§13.2) closes substitution of block contents by a hostile or corrupted store.
- Unverified import binds keys to bytes on the importer's authority alone and SHOULD be reserved for input whose provenance already guarantees integrity.
- Ref-name aliasing (§10.2) is a data-loss vector when combined with garbage collection; the name rules exist to close it and MUST NOT be relaxed.
- Symlink targets, names, and note fields are attacker-chosen strings; anything that displays or matches on them MUST treat them as untrusted (§13.2, error prose).
- Materialization. Extracting an untrusted tree to a real filesystem
is the tar/zip-slip CVE class: symlink targets, hardlink groups, device
entries, and mode bits are all attacker-chosen. Extractors:
- MUST resolve every destination path without following
previously-extracted symlinks — create symlinks last, or use
O_NOFOLLOW-style / directory-descriptor-relative opens throughout; - MUST confine all created paths — including the interpretation of
symlink targets (§7.3) and of hardlink (
ino, §7.2) link targets — to the extraction root; a hardlink group member MUST NOT be linked to any path outside it; - SHOULD NOT create device nodes or fifos by default;
- SHOULD NOT apply setuid/setgid/sticky bits (
m, §7.2) by default.
- MUST resolve every destination path without following
previously-extracted symlinks — create symlinks last, or use