Ousama Ben Younes ac9b22c4d9 fix(install): reject archive with path traversal before extraction (#1250) ...

The installer previously ran `tar -xzf` on the downloaded archive with no
pre-extraction verification. A malicious mirror could ship a tarball with
`../` components or absolute paths and write files anywhere on the user's
filesystem (CWE-22).

Add a pre-extraction check that lists archive contents with `tar -tzf`
and rejects any entry whose name starts with `/` or contains a `..` path
component. The check is POSIX-compliant and adds negligible overhead for
the single-binary RTK release tarball.

Covered by scripts/test-install.sh, which exercises one safe archive
and four crafted malicious archives (leading `..`, absolute path,
mid-path `..`, trailing `..`) plus a regression guard that ensures the
check remains in install.sh.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-04-17 15:55:32 +00:00

2.5 KiB

Executable File

Raw Permalink Blame History

View Raw