fixup: validate path in tar header

Signed-off-by: Matej Vasek <[email protected]>
knative · Dec 12, 2023 · 6d08815 · 6d08815
1 parent f554f97
commit 6d08815
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/hack/update-builder.go b/hack/update-builder.go
@@ -604,7 +604,12 @@ func downloadTarball(tarballUrl, destDir string) error {
 			return fmt.Errorf("cannot read tar header: %w", err)
 		}
 
-		dest := filepath.Join(destDir, filepath.Join(strings.Split(hdr.Name, "/")[1:]...))
+		n := filepath.Clean(filepath.Join(strings.Split(hdr.Name, "/")[1:]...))
+		if strings.HasPrefix(n, "..") {
+			return fmt.Errorf("path in tar header escapes")
+		}
+		dest := filepath.Join(destDir, n)
+
 		switch hdr.Typeflag {
 		case tar.TypeReg:
 			var f *os.File