Embedded NUL in an xattr PAX keyword is accepted

[zaniebot]

Summary

TarReader accepts an embedded NUL in an extended-attribute PAX keyword. The
reproduction archive is Go's open-source pax-nul-xattrs.tar
fixture; Go archive/tar rejects it while the other maintained readers accept.

Tested at 1ac1199559a1b96f0f953ac99520ccc296503808.

Observed behavior

The record keyword contains SCHILY.xattr.null\0. Tar-codec classifies it as
vendor metadata and returns the member.

Expected behavior

Consider rejecting NUL-bearing PAX keywords before vendor or xattr policy is
applied.

Impact

An xattr name can acquire different identities across Rust strings, C APIs, and
filesystem interfaces.

[woodruffw]

Hmm. This is allowed under pax, but I guess it's a sane thing to reject. I'm not sure.

[zanieb]

You could argue that Go's implementation is wrong. It might be worth looking into their justification?

[woodruffw]

Yeah, I'll look into it on their side. If I had to guess they probably reject it defensively which wouldn't be a bad argument for us either, I guess!