:fix: path traversal bug

- fixes #438 Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
defenseunicorns · Feb 22, 2024 · 05a05ed · 05a05ed
1 parent d764462
commit 05a05ed
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/pkg/sources/tarball.go b/src/pkg/sources/tarball.go
@@ -216,8 +216,13 @@ func (t *TarballBundle) extractPkgFromBundle() ([]string, error) {
 		})
 
 		path := desc.Annotations[ocispec.AnnotationTitle]
+		cleanPath := filepath.Clean(path)
+		if strings.Contains(cleanPath, "..") {
+			// Log the attempt or handle it as needed
+			return fmt.Errorf("invalid path detected: %s", path)
+		}
 		size := desc.Size
-		layerDst := filepath.Join(t.TmpDir, path)
+		layerDst := filepath.Join(t.TmpDir, cleanPath)
 		if err := zarfUtils.CreateDirectory(filepath.Dir(layerDst), 0700); err != nil {
 			return err
 		}