Protect Untar function from a zip slip. (#2459)

grafana · Jan 22, 2025 · 7dcb41a · 7dcb41a
1 parent 51ed068
commit 7dcb41a
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/internal/util/untar.go b/internal/util/untar.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 // Untar untars a tarball to the provided destination path.
@@ -31,6 +32,13 @@ func Untar(tarPath string, destPath string) error {
 			return err
 		}
 
+		// Protect from a zip slip.
+		// https://security.snyk.io/research/zip-slip-vulnerability
+		if strings.Contains(header.Name, `../`) ||
+			strings.Contains(header.Name, `..\`) {
+			return fmt.Errorf("tar: invalid file path: %s", header.Name)
+		}
+
 		fullPath := filepath.Join(destPath, header.Name)
 		switch header.Typeflag {
 		case tar.TypeDir: