Fix code scanning alert no. 49: Arbitrary file access during archive extraction ("Zip Slip")

cmd/errors/errors.go

@@ -58,6 +58,7 @@ var (
 	ErrPathAlreadyExists         = errors.New("path already exists")
 	ErrCopyingEqualPaths         = errors.New("failed copying files: source is the same as destination")
 	ErrMovingEqualPaths          = errors.New("failed moving files: source is the same as destination")
+	ErrInvalidFilePath           = errors.New("invalid file path")
 
 	// Cryptography errors
 	ErrIntegrityCheckFailed  = errors.New("checksum verification failed")

cmd/installer/pack.go

@@ -166,6 +166,12 @@ func (p *PackType) validate() error {
 				p.Subfolder = filepath.Dir(file.Name)
 			}
 
+			// Ensure the file path does not contain ".."
+			if strings.Contains(file.Name, "..") {
+				log.Errorf("File \"%s\" invalid file path", file.Name)
+				return errs.ErrInvalidFilePath
+			}
+
 			// Read pack's pdsc
 			tmpPdscFileName := filepath.Join(os.TempDir(), utils.RandStringBytes(10))
 			defer os.RemoveAll(tmpPdscFileName)
@@ -198,6 +204,10 @@ func (p *PackType) validate() error {
 
 			p.Pdsc.FileName = file.Name
 			return nil
+		} else {
+			if strings.Contains(file.Name, "..") {
+				return errs.ErrInsecureZipFileName
+			}
 		}
 	}
 

cmd/installer/root_pack_add_test.go

@@ -311,6 +311,25 @@ func TestAddPack(t *testing.T) {
 		assert.False(utils.FileExists(installer.Installation.PackIdx))
 	})
 
+	t.Run("test installing a pack with .. in pdsc name", func(t *testing.T) {
+		localTestingDir := "test-add-pack-with-dot-dot-name"
+		assert.Nil(installer.SetPackRoot(localTestingDir, CreatePackRoot))
+		installer.UnlockPackRoot()
+		installer.Installation.WebDir = filepath.Join(testDir, "public_index")
+		defer removePackRoot(localTestingDir)
+
+		packPath := packWithParentDirectoryFiles
+
+		err := installer.AddPack(packPath, !CheckEula, !ExtractEula, !ForceReinstall, !NoRequirements, Timeout)
+
+		// Sanity check
+		assert.NotNil(err)
+		assert.Equal(errs.ErrInvalidFilePath, err)
+
+		// Make sure pack.idx never got touched
+		assert.False(utils.FileExists(installer.Installation.PackIdx))
+	})
+
 	t.Run("test installing a pack with version not present in the pdsc file", func(t *testing.T) {
 		localTestingDir := "test-add-pack-with-version-not-present-in-the-pdsc-file"
 		assert.Nil(installer.SetPackRoot(localTestingDir, CreatePackRoot))

cmd/installer/root_test.go

@@ -240,6 +240,7 @@ var (
 	packWithMalformedURL           = "http://:malformed-url*/TheVendor.PackName.1.2.3.pack"
 	packWithoutPdscFileInside      = filepath.Join(testDir, "PackWithout.PdscFileInside.1.2.3.pack")
 	packWithTaintedCompressedFiles = filepath.Join(testDir, "PackWith.TaintedFiles.1.2.3.pack")
+	packWithParentDirectoryFiles   = filepath.Join(testDir, "PackWith.ParentDirectoryFiles.1.2.3.pack")
 
 	// Packs with packid names only
 	publicRemotePackPackID         = "TheVendor.PublicRemotePack"