fix(utils): reject tar hardlinks that escape the extraction root

ExtractArchive pre-scans archive members and rejects symlinks, but tar
hardlink entries carry a regular file mode and so pass that check.
Header.Linkname was never validated, so an archive could create a link
to a path outside the destination directory.

Validate Linkname with the same path check already applied to member
names. Hardlinks that resolve inside the extraction root still extract,
so ordinary archives are unaffected.

pkg/oci/image.go already resolves tar.TypeLink targets before using
them; this brings the archive extraction path in line with it.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Zelys-DFKH <zelys@dfkhelper.com>

Author: Zelys-DFKH

pkg/utils/untar.go

@@ -70,6 +70,11 @@ func ExtractArchive(archive, dst string) error {
 		if f.FileInfo.Mode()&os.ModeSymlink != 0 {
 			return fmt.Errorf("archive contains a symlink")
 		}
+		if linkname, ok := archiveMemberLinkname(f); ok {
+			if err := validateArchiveMemberPath(extractRoot, linkname); err != nil {
+				return err
+			}
+		}
 		return nil
 	})
 
@@ -95,6 +100,18 @@ func archiveMemberName(f archiver.File) string {
 	}
 }
 
+// archiveMemberLinkname reports the target of a tar hardlink member, which carries a regular file mode and so is not caught by the symlink check.
+func archiveMemberLinkname(f archiver.File) (string, bool) {
+	switch h := f.Header.(type) {
+	case tar.Header:
+		return h.Linkname, h.Typeflag == tar.TypeLink
+	case *tar.Header:
+		return h.Linkname, h.Typeflag == tar.TypeLink
+	default:
+		return "", false
+	}
+}
+
 func validateArchiveMemberPath(root, name string) error {
 	if name == "" {
 		return fmt.Errorf("archive contains an empty path")

pkg/utils/untar_test.go

@@ -59,6 +59,20 @@ var _ = Describe("utils/archive tests", func() {
 		Expect(err.Error()).To(ContainSubstring("unsafe path"))
 		Expect(filepath.Join(tmpDir, "escaped.txt")).ToNot(BeAnExistingFile())
 	})
+
+	It("rejects tar hardlinks that point outside the destination", func() {
+		tmpDir := GinkgoT().TempDir()
+		archivePath := filepath.Join(tmpDir, "model.tar")
+		extractPath := filepath.Join(tmpDir, "models")
+
+		Expect(writeTarArchiveWithHardlink(archivePath, "payload.bin", "../../escaped.txt")).To(Succeed())
+
+		err := ExtractArchive(archivePath, extractPath)
+
+		Expect(err).To(HaveOccurred())
+		Expect(err.Error()).To(ContainSubstring("unsafe path"))
+		Expect(filepath.Join(tmpDir, "escaped.txt")).ToNot(BeAnExistingFile())
+	})
 })
 
 func writeZipArchive(path string, files map[string]string) (err error) {
@@ -126,3 +140,29 @@ func writeTarArchive(path string, files map[string]string) (err error) {
 
 	return nil
 }
+
+func writeTarArchiveWithHardlink(path, name, linkname string) (err error) {
+	out, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if closeErr := out.Close(); err == nil {
+			err = closeErr
+		}
+	}()
+
+	writer := tar.NewWriter(out)
+	defer func() {
+		if closeErr := writer.Close(); err == nil {
+			err = closeErr
+		}
+	}()
+
+	return writer.WriteHeader(&tar.Header{
+		Name:     name,
+		Linkname: linkname,
+		Typeflag: tar.TypeLink,
+		Mode:     0o600,
+	})
+}