command-injection: GNU tar and bsdtar read -I and --to-command differently #221

Decision to take

The option model of command-injection (#217) treats these tar options as running a command their value chooses:

• --to-command, --checkpoint-action: GNU tar only; bsdtar (the macOS tar) does not support them;
• -I: GNU tar runs the compressor it names; bsdtar reads -I as a file of include patterns.

They were kept so that a GNU tar invocation is not under-reported: on bsdtar, tar f"-I{x}" is reported high though it runs nothing (a false positive). Checked on macOS: bsdtar rejects --to-command and reads -I as a patterns file.

To settle

• Keep the GNU reading for every tar (current behaviour: false positives on bsdtar, no false negative on GNU tar);
• or make -I (and the GNU-only options) a finding kept for review (high, hotspot) since the implementation cannot be told from the command;
• or tell the implementations apart when the program names one (gtar, bsdtar), keeping the current reading for a bare tar.