lib/os: check for extract path in untar and unzip

Once we Join-ed the directory output with the file name, we check if
the result of join is still under directory output, if its not, return
an error to prevent Zip Slip vulnerability [1].

[1] https://cwe.mitre.org/data/definitions/22.html

1 files changed, 8 insertions, 0 deletions

diff --git a/lib/os/extract.go b/lib/os/extract.go
index 324dd3c2..becead88 100644
--- a/lib/os/extract.go
+++ b/lib/os/extract.go
@@ -322,6 +322,10 @@ func (xtrk *extractor) untar(fin io.Reader) (err error) {
 		fi = hdr.FileInfo()
 		filePath = filepath.Join(xtrk.dirOutput, hdr.Name)
 
+		if !strings.HasPrefix(filePath, xtrk.dirOutput) {
+			return fmt.Errorf(`%s: extract path outside of output directory`, logp)
+		}
+
 		if fi.IsDir() {
 			err = os.Mkdir(filePath, fi.Mode())
 			if err != nil {
@@ -397,6 +401,10 @@ func (xtrk *extractor) unzip(fin *os.File) (err error) {
 		fi = zipFile.FileInfo()
 		filePath = filepath.Join(xtrk.dirOutput, zipFile.Name)
 
+		if !strings.HasPrefix(filePath, xtrk.dirOutput) {
+			return fmt.Errorf(`%s: extract path outside of output directory`, logp)
+		}
+
 		if fi.IsDir() {
 			err = os.Mkdir(filePath, fi.Mode())
 			if err != nil {