remove isAbs since .Join covers this check

internal/unpackinfo/unpackinfo.go

@@ -37,19 +37,14 @@ func NewUnpackInfo(dst string, header *tar.Header) (UnpackInfo, error) {
 
 	// Clean the destination path
 	dst = filepath.Clean(dst)
-
-	// Get rid of absolute paths.
-	path := header.Name
-	if filepath.IsAbs(path) {
-		path = path[1:]
-	}
+	path := filepath.Clean(header.Name)
 
 	path = filepath.Join(dst, path)
 	target := filepath.Clean(path)
 
 	// Check for path traversal by ensuring the target is within the destination
 	rel, err := filepath.Rel(dst, target)
-	if err != nil || strings.HasPrefix(rel, "..") || strings.Contains(dst, "..") || strings.Contains(target, "..") || filepath.IsAbs(rel) {
+	if err != nil || strings.HasPrefix(rel, "..") || strings.Contains(dst, "..") || strings.Contains(path, "..") || strings.Contains(target, "..") {
 		return UnpackInfo{}, errors.New("invalid filename, traversal with \"..\" outside of current directory")
 	}
 

internal/unpackinfo/unpackinfo_test.go

@@ -145,7 +145,8 @@ func TestNewUnpackInfo(t *testing.T) {
 		}
 	})
 	t.Run("destination starting with ./", func(t *testing.T) {
-		outsideDst := filepath.Join("./" + t.TempDir())
+		dst := t.TempDir()
+		outsideDst := "./" + dst
 		result, err := NewUnpackInfo(outsideDst, &tar.Header{
 			Name:     "foo.txt",
 			Typeflag: tar.TypeSymlink,
@@ -163,8 +164,23 @@ func TestNewUnpackInfo(t *testing.T) {
 
 	t.Run("destination starting with ./ followed with ../", func(t *testing.T) {
 		dst := t.TempDir()
-		outsideDst := filepath.Join("./../../" + dst)
-		_, err := NewUnpackInfo(outsideDst, &tar.Header{
+		_, err := NewUnpackInfo("./../../"+dst, &tar.Header{
+			Name:     "foo.txt",
+			Typeflag: tar.TypeSymlink,
+		})
+
+		if err == nil {
+			t.Fatal("expected error, got nil")
+		}
+
+		expected := "traversal with \"..\" outside of current"
+		if !strings.Contains(err.Error(), expected) {
+			t.Fatalf("expected error to contain %q, got %q", expected, err)
+		}
+	})
+	t.Run("destination followed with ../", func(t *testing.T) {
+		dst := t.TempDir()
+		_, err := NewUnpackInfo(dst+"../../foo", &tar.Header{
 			Name:     "foo.txt",
 			Typeflag: tar.TypeSymlink,
 		})