Avoid path traversal with hard-link in tar files

Author: cmaglie

evil_generator/main.go

@@ -22,6 +22,11 @@ func main() {
 		log.Fatalf("Output path %s is not a directory", outputDir)
 	}
 
+	generateEvilZipSlip(outputDir)
+	generateEvilSymLinkPathTraversalTar(outputDir)
+}
+
+func generateEvilZipSlip(outputDir *paths.Path) {
 	evilPathTraversalFiles := []string{
 		"..",
 		"../../../../../../../../../../../../../../../../../../../../tmp/evil.txt",
@@ -104,3 +109,21 @@ func main() {
 		}
 	}
 }
+
+func generateEvilSymLinkPathTraversalTar(outputDir *paths.Path) {
+	outputTarFile, err := outputDir.Join("evil-link-traversal.tar").Create()
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer outputTarFile.Close()
+
+	tw := tar.NewWriter(outputTarFile)
+	defer tw.Close()
+
+	if err := tw.WriteHeader(&tar.Header{
+		Name: "leak", Linkname: "../../../../../../../../../../../../../../../tmp/something-important",
+		Mode: 0o0777, Size: 0, Typeflag: tar.TypeLink,
+	}); err != nil {
+		log.Fatal(err)
+	}
+}

extractor.go

@@ -217,7 +217,10 @@ func (e *Extractor) Tar(ctx context.Context, body io.Reader, location string, re
 				name = rename(name)
 			}
 
-			name = filepath.Join(location, name)
+			name, err = safeJoin(location, name)
+			if err != nil {
+				continue
+			}
 			links = append(links, &link{Path: path, Name: name})
 		case tar.TypeSymlink:
 			symlinks = append(symlinks, &link{Path: path, Name: header.Linkname})

extractor_test.go

@@ -65,7 +65,7 @@ func testArchive(t *testing.T, archivePath *paths.Path) {
 }
 
 func TestZipSlipHardening(t *testing.T) {
-	{
+	t.Run("ZipTraversal", func(t *testing.T) {
 		logger := &LoggingFS{}
 		extractor := extract.Extractor{FS: logger}
 		data, err := os.Open("testdata/zipslip/evil.zip")
@@ -74,8 +74,9 @@ func TestZipSlipHardening(t *testing.T) {
 		require.NoError(t, data.Close())
 		fmt.Print(logger)
 		require.Empty(t, logger.Journal)
-	}
-	{
+	})
+
+	t.Run("TarTraversal", func(t *testing.T) {
 		logger := &LoggingFS{}
 		extractor := extract.Extractor{FS: logger}
 		data, err := os.Open("testdata/zipslip/evil.tar")
@@ -84,9 +85,23 @@ func TestZipSlipHardening(t *testing.T) {
 		require.NoError(t, data.Close())
 		fmt.Print(logger)
 		require.Empty(t, logger.Journal)
-	}
+	})
+
+	t.Run("TarLinkTraversal", func(t *testing.T) {
+		logger := &LoggingFS{}
+		extractor := extract.Extractor{FS: logger}
+		data, err := os.Open("testdata/zipslip/evil-link-traversal.tar")
+		require.NoError(t, err)
+		require.NoError(t, extractor.Tar(context.Background(), data, "/tmp/test", nil))
+		require.NoError(t, data.Close())
+		fmt.Print(logger)
+		require.Empty(t, logger.Journal)
+	})
 
-	if runtime.GOOS == "windows" {
+	t.Run("WindowsTarTraversal", func(t *testing.T) {
+		if runtime.GOOS != "windows" {
+			t.Skip("Skipped on non-Windows host")
+		}
 		logger := &LoggingFS{}
 		extractor := extract.Extractor{FS: logger}
 		data, err := os.Open("testdata/zipslip/evil-win.tar")
@@ -95,7 +110,7 @@ func TestZipSlipHardening(t *testing.T) {
 		require.NoError(t, data.Close())
 		fmt.Print(logger)
 		require.Empty(t, logger.Journal)
-	}
+	})
 }
 
 // MockDisk is a disk that chroots to a directory