ayo/kitty
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix failure of tarfile extract when dest_path has symlinks

Browse source
This commit is contained in:
Kovid Goyal 2025-04-21 09:46:30 +05:30
parent 4d69eea4af
commit 6f673929eb
No known key found for this signature in database
GPG key ID: 06BC317B515ACE7C
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
tools/utils/tar.go
View file

@ -171,10 +171,13 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
if len(optss) > 0 {
opts = optss[0]
}
dest_path, err = filepath.Abs(dest_path)
if err != nil {
if dest_path, err = filepath.Abs(dest_path); err != nil {
return
}
if dest_path, err = filepath.EvalSymlinks(dest_path); err != nil {
return
}
dest_path = filepath.Clean(dest_path)
mode := func(hdr int64) fs.FileMode {
return fs.FileMode(hdr) & (fs.ModePerm | fs.ModeSetgid | fs.ModeSetuid | fs.ModeSticky)
@ -190,6 +193,7 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
count++
return
}
needed_prefix := dest_path + string(os.PathSeparator)
for {
var hdr *tar.Header
@ -208,7 +212,7 @@ func ExtractAllFromTar(tr *tar.Reader, dest_path string, optss ...TarExtractOpti
if dest, err = EvalSymlinksThatExist(dest); err != nil {
return count, err
}
if !strings.HasPrefix(filepath.Clean(dest), filepath.Clean(dest_path)+string(os.PathSeparator)) {
if !strings.HasPrefix(dest, needed_prefix) {
continue
}
switch hdr.Typeflag {