RPM hasn't used true cpio for a while [since 2013] because cpio didn't support > 4GB files. It now uses its own format which it evolved from cpio.
Seems they still use the same logic though: https://github.com/rpm-software-management/rpm/blob/853c48ba...
That doesn't actually matter though does it, because RPM is no longer using cpio, it's now using a custom format that happens to once have been related to cpio. What matters is what RPM does, not what cpio does.
In this case it's not possible to create such an archive using rpmbuild as all files added to RPMs much start with "/". I just tried it and got:
RPM build errors:
File must begin with "/": TRAILER!!!
In other words this is essentially a non-problem for RPM.
The comparison is just to the filename, not including the path. You may be right, but that check doesn't prove it.
Edit: Thanks for the reply! Apparently they are including the path.
I can create an RPM containing a filename "TRAILER!!!" just fine:
$ rpm -qlp /home/rjones/d/fedora/virt-what/master/x86_64/virt-what-1.20-1.fc33.x86_64.rpm
/TRAILER!!!
/usr/lib/.build-id
/usr/lib/.build-id/59
/usr/lib/.build-id/59/59c1cb95689b7babd5a6cb1b5bc58f12e20b3a
/usr/libexec/virt-what-cpuid-helper
/usr/sbin/virt-what
/usr/share/doc/virt-what
/usr/share/doc/virt-what/COPYING
/usr/share/doc/virt-what/README
/usr/share/man/man1/virt-what.1.gz
All of which are administrative formats that do not include user data. I can't think of a way that this "feature" could be abused in those contexts to cause a security problem.
If, say, an anti-virus program extracts an RPM's contents and scans each file separately, then it might miss files smuggled in that would be readable by malware with a custom cpio extractor.
From Wikipedia:
> The use of cpio by the RPM Package Manager, in the initramfs program of Linux kernel 2.6, and in Apple's Installer (pax) make cpio an important archiving tool.