[security] Fix path injection

vertex-center · Sep 25, 2023 · 45f3b28 · 45f3b28
1 parent 2c770d4
commit 45f3b28
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/pkg/varchiver/tar.go b/pkg/varchiver/tar.go
@@ -33,6 +33,10 @@ func Unzip(src string, dest string) error {
 
 		p := path.Join(dest, header.Name)
 
+		if !filepath.IsLocal(p) {
+			return ErrMustBeLocal
+		}
+
 		if header.FileInfo().IsDir() {
 			err = os.MkdirAll(p, os.ModePerm)
 			if err != nil {
@@ -108,6 +112,10 @@ func Untar(src string, dest string) error {
 
 		p := path.Join(dest, header.Name)
 
+		if !filepath.IsLocal(p) {
+			return ErrMustBeLocal
+		}
+
 		switch header.Typeflag {
 		case tar.TypeDir:
 			err = os.MkdirAll(p, os.ModePerm)