fix: disallow use of .. in tar file paths

einride · Oct 13, 2022 · 16b49a3 · 16b49a3
1 parent 3182c05
commit 16b49a3
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/sgtool/file.go b/sgtool/file.go
@@ -331,9 +331,11 @@ func (s *fileState) extractTar(reader io.Reader) error {
 		if name, ok := s.archiveFiles[dstName]; ok {
 			dstName = name
 		}
-
 		//nolint:gosec // allow traversal into archive
 		path := filepath.Join(s.dstPath, dstName)
+		if strings.Contains(path, "..") {
+			return fmt.Errorf("encountered .. inside tar filepath (%s). For security reasons, this is not allowed", path)
+		}
 
 		switch header.Typeflag {
 		case tar.TypeDir: