fix tar path issue with parent directory (#147)

* fix tar path issue Signed-off-by: hirokuni-kitahara <[email protected]> * update path check Signed-off-by: hirokuni-kitahara <[email protected]> --------- Signed-off-by: hirokuni-kitahara <[email protected]>
sigstore · Dec 3, 2024 · f7da642 · f7da642
1 parent 2fde1f9
commit f7da642
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/pkg/util/image.go b/pkg/util/image.go
@@ -147,6 +147,12 @@ func GetYAMLsInArtifact(blob []byte) ([][]byte, error) {
 			return nil, errors.Wrap(err, "tarReader.Next() failed while decompressing tar gz")
 		}
 
+		// Skip files that have path starting with ".."
+		// Ref: CWE-22
+		if strings.HasPrefix(header.Name, "..") {
+			continue
+		}
+
 		switch header.Typeflag {
 		case tar.TypeDir:
 			fpath := filepath.Join(dir, header.Name)