Skip to content

Commit

Permalink
Fix code scanning alert no. 6: Arbitrary file access during archive e…
Browse files Browse the repository at this point in the history
…xtraction ("Zip Slip")

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
  • Loading branch information
yarlson and github-advanced-security[bot] authored Nov 4, 2024
1 parent cc60f6b commit c8e15d3
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions pkg/dockersync/dockersync.go
Original file line number Diff line number Diff line change
Expand Up @@ -233,7 +233,17 @@ func extractTar(ctx context.Context, tarPath, destPath string) error {
return fmt.Errorf("tar reading error: %w", err)
}

// Ensure the header name does not contain ".."
if strings.Contains(header.Name, "..") {
return fmt.Errorf("invalid file path in tar archive: %s", header.Name)
}

// Clean the target path and ensure it is within destPath
target := filepath.Join(destPath, header.Name)
target = filepath.Clean(target)
if !strings.HasPrefix(target, filepath.Clean(destPath)+string(os.PathSeparator)) {
return fmt.Errorf("invalid file path in tar archive: %s", header.Name)
}

switch header.Typeflag {
case tar.TypeDir:
Expand Down

0 comments on commit c8e15d3

Please sign in to comment.