mirror/LocalAI
1
0
Fork 0
mirror of https://github.com/mudler/LocalAI.git synced 2026-07-30 09:57:57 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(oci): reject path-traversal tar entries in the link-copy fallback

Browse Source 
safeJoin sanitized "../.." entries by clamping them under root instead of
rejecting them, so a malicious entry was silently redirected rather than
refused. Join without the leading-slash trick and reject any entry whose
cleaned path resolves outside root; absolute link targets are still mapped
under root (image-root relative) rather than escaping.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:opus-4.8 [Claude Code]
This commit is contained in:
Ettore Di Giacinto
2026-07-17 18:39:21 +00:00
committed by localai-org-maint-bot
parent 2923618a8d
commit a496d989ae
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/oci/image.go
View File

@@ -618,11 +618,13 @@ func extractTarCopyingLinks(r io.Reader, targetDestination string) error {
}
// safeJoin joins name onto root and guarantees the result stays within root,
// guarding against path-traversal entries in a malicious tar.
// rejecting path-traversal entries in a malicious tar. An absolute name (e.g. an
// absolute symlink target) is treated as image-root relative, so it is mapped
// under root rather than escaping it.
func safeJoin(root, name string) (string, error) {
cleaned := filepath.Join(root, filepath.Clean("/"+name))
cleaned := filepath.Join(root, name)
rel, err := filepath.Rel(root, cleaned)
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) || filepath.IsAbs(rel) {
return "", fmt.Errorf("tar entry escapes extraction root: %s", name)
}
return cleaned, nil