Allow links outside the extraction directory

Author: am11

src/libraries/System.Formats.Tar/src/System/Formats/Tar/TarEntry.cs

@@ -349,16 +349,7 @@ internal Task ExtractRelativeToDirectoryAsync(string destinationDirectoryPath, b
                     throw new InvalidDataException(SR.TarEntryHardLinkOrSymlinkLinkNameEmpty);
                 }
 
-                linkTargetPath = GetSanitizedFullPath(destinationDirectoryPath,
-                    Path.IsPathFullyQualified(LinkName) ? LinkName : Path.Join(Path.GetDirectoryName(fileDestinationPath), LinkName));
-
-                if (linkTargetPath == null)
-                {
-                    throw new IOException(SR.Format(SR.TarExtractingResultsLinkOutside, LinkName, destinationDirectoryPath));
-                }
-
-                // after TarExtractingResultsLinkOutside validation, preserve the original
-                // symlink target path (to match behavior of other utilities).
+                // preserve the original symlink target path (to match behavior of other utilities).
                 linkTargetPath = LinkName;
             }
 

src/libraries/System.Formats.Tar/tests/TarFile/TarFile.ExtractToDirectory.Stream.Tests.cs

@@ -78,21 +78,62 @@ public void ExtractEntry_ManySubfolderSegments_NoPrecedingDirectoryEntries()
         [InlineData(TarEntryType.HardLink)]
         public void Extract_LinkEntry_TargetOutsideDirectory(TarEntryType entryType)
         {
+            using TempDirectory tempDirectory = new();
+            string symlinkName = tempDirectory.GenerateRandomFilePath();
+            File.WriteAllText(symlinkName, new string('x', 100));
+
             using MemoryStream archive = new MemoryStream();
             using (TarWriter writer = new TarWriter(archive, TarEntryFormat.Ustar, leaveOpen: true))
             {
                 UstarTarEntry entry = new UstarTarEntry(entryType, "link");
-                entry.LinkName = PlatformDetection.IsWindows ? @"C:\Windows\System32\notepad.exe" : "/usr/bin/nano";
+                entry.LinkName = symlinkName;
+                writer.WriteEntry(entry);
+            }
+
+            archive.Seek(0, SeekOrigin.Begin);
+
+            using TempDirectory root = new TempDirectory();
+
+            Exception exception = Record.Exception(() => TarFile.ExtractToDirectory(archive, root.Path, overwriteFiles: true));
+            Assert.Null(exception);
+
+            string symlinkPath = Path.Join(root.Path, "link");
+            Assert.True(File.Exists(symlinkPath));
+
+            if (entryType is TarEntryType.SymbolicLink)
+            {
+                FileInfo? fileInfo = new(symlinkPath);
+                Assert.Equal(symlinkName, fileInfo.LinkTarget);
+            }
+        }
+
+        [Theory]
+        [InlineData("foo")]
+        [InlineData("../../foo")]
+        [InlineData("/usr/tmp/foo")]
+        [InlineData(@"C:\tmp\foo")]
+        public void Extract_SymbolicLinkEntryWithExistingOrNonExistingPaths_TargetOutsideDirectoryPreservesOriginalPaths(string symlinkName)
+        {
+            using MemoryStream archive = new();
+            using (TarWriter writer = new(archive, TarEntryFormat.Ustar, leaveOpen: true))
+            {
+                UstarTarEntry entry = new UstarTarEntry(TarEntryType.SymbolicLink, "link");
+                entry.LinkName = symlinkName;
                 writer.WriteEntry(entry);
             }
 
             archive.Seek(0, SeekOrigin.Begin);
 
             using TempDirectory root = new TempDirectory();
 
-            Assert.Throws<IOException>(() => TarFile.ExtractToDirectory(archive, root.Path, overwriteFiles: false));
+            Exception exception = Record.Exception(() => TarFile.ExtractToDirectory(archive, root.Path, overwriteFiles: true));
+            Assert.Null(exception);
+
+            string symlinkPath = Path.Join(root.Path, "link");
+            Assert.True(File.Exists(symlinkPath));
 
-            Assert.Equal(0, Directory.GetFileSystemEntries(root.Path).Count());
+            FileInfo? fileInfo = new(symlinkPath);
+            Assert.Equal(symlinkName, fileInfo.LinkTarget);
         }
 
         [ConditionalTheory(typeof(MountHelper), nameof(MountHelper.CanCreateSymbolicLinks))]

src/libraries/System.Formats.Tar/tests/TarFile/TarFile.ExtractToDirectoryAsync.Stream.Tests.cs

@@ -138,22 +138,65 @@ public async Task ExtractEntry_PodmanImageTarWithRelativeSymlinksPointingInExtra
         [InlineData(TarEntryType.HardLink)]
         public async Task Extract_LinkEntry_TargetOutsideDirectory_Async(TarEntryType entryType)
         {
+            using TempDirectory tempDirectory = new();
+            string symlinkName = tempDirectory.GenerateRandomFilePath();
+            await File.WriteAllTextAsync(symlinkName, new string('x', 100));
+
             await using (MemoryStream archive = new MemoryStream())
             {
                 await using (TarWriter writer = new TarWriter(archive, TarEntryFormat.Ustar, leaveOpen: true))
                 {
                     UstarTarEntry entry = new UstarTarEntry(entryType, "link");
-                    entry.LinkName = PlatformDetection.IsWindows ? @"C:\Windows\System32\notepad.exe" : "/usr/bin/nano";
+                    entry.LinkName = symlinkName;
                     await writer.WriteEntryAsync(entry);
                 }
 
                 archive.Seek(0, SeekOrigin.Begin);
 
-                using (TempDirectory root = new TempDirectory())
+                using TempDirectory root = new TempDirectory();
+
+                Exception exception = await Record.ExceptionAsync(() => TarFile.ExtractToDirectoryAsync(archive, root.Path, overwriteFiles: true));
+                Assert.Null(exception);
+
+                string symlinkPath = Path.Join(root.Path, "link");
+                Assert.True(File.Exists(symlinkPath));
+
+                if (entryType is TarEntryType.SymbolicLink)
+                {
+                    FileInfo? fileInfo = new(symlinkPath);
+                    Assert.Equal(symlinkName, fileInfo.LinkTarget);
+                }
+            }
+        }
+
+        [Theory]
+        [InlineData("foo")]
+        [InlineData("../../foo")]
+        [InlineData("/usr/tmp/foo")]
+        [InlineData(@"C:\tmp\foo")]
+        public async Task Extract_SymbolicLinkEntryWithExistingOrNonExistingPaths_TargetOutsideDirectoryPreservesOriginalPaths_Async(string symlinkName)
+        {
+            await using (MemoryStream archive = new())
+            {
+                await using (TarWriter writer = new(archive, TarEntryFormat.Ustar, leaveOpen: true))
                 {
-                    await Assert.ThrowsAsync<IOException>(() => TarFile.ExtractToDirectoryAsync(archive, root.Path, overwriteFiles: false));
-                    Assert.Equal(0, Directory.GetFileSystemEntries(root.Path).Count());
+                    UstarTarEntry entry = new UstarTarEntry(TarEntryType.SymbolicLink, "link");
+                    entry.LinkName = symlinkName;
+                    await writer.WriteEntryAsync(entry);
                 }
+
+                archive.Seek(0, SeekOrigin.Begin);
+
+                using TempDirectory root = new TempDirectory();
+
+                Exception exception = await Record.ExceptionAsync(() => TarFile.ExtractToDirectoryAsync(archive, root.Path, overwriteFiles: true));
+                Assert.Null(exception);
+
+                string symlinkPath = Path.Join(root.Path, "link");
+                Assert.True(File.Exists(symlinkPath));
+
+                FileInfo? fileInfo = new(symlinkPath);
+                Assert.Equal(symlinkName, fileInfo.LinkTarget);
             }
         }