From 58969781b4ee1c9b63668a7dae0a44967f450ffa Mon Sep 17 00:00:00 2001 From: Pegleg Date: Tue, 16 Sep 2025 20:56:52 -0700 Subject: [PATCH] Potential fix for code scanning alert no. 2: Arbitrary file access during archive extraction ("Zip Slip") Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- main.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/main.go b/main.go index 4992643..af99562 100644 --- a/main.go +++ b/main.go @@ -279,13 +279,21 @@ func extractImageLayers(imageStream io.ReadCloser, imageID string, history []doc color.Red("%s", err) } name := hdrr.Name + cleanPath := filepath.Clean(name) + absExtractDir := filepath.Join(outputDir, layerID) + finalPath := filepath.Join(absExtractDir, cleanPath) + // Ensure path is not absolute and stays within extract dir + if !strings.HasPrefix(finalPath, absExtractDir+string(os.PathSeparator)) && finalPath != absExtractDir { + color.Red("Skipping suspicious archive entry: %s", name) + continue + } switch hdrr.Typeflag { case tar.TypeDir: - os.MkdirAll(filepath.Join(outputDir, layerID, name), FilePerms) + os.MkdirAll(finalPath, FilePerms) case tar.TypeReg: data := make([]byte, hdrr.Size) ttr.Read(data) - os.WriteFile(filepath.Join(outputDir, layerID, name), data, FilePerms) + os.WriteFile(finalPath, data, FilePerms) } } }