CHEF-38211: Reject path traversal via @LongLink entries in Tar extraction

lib/mixlib/archive/tar.rb

@@ -26,18 +26,26 @@ def initialize(archive, options = {})
       def extract(destination, perms: true, ignore: [])
         # (http://stackoverflow.com/a/31310593/506908)
         ignore_re = Regexp.union(ignore)
+        destination_root = File.expand_path(destination)
         reader do |tar|
           dest = nil
           tar.each do |entry|
             if entry.full_name == TAR_LONGLINK
-              dest = File.join(destination, entry.read.strip)
+              dest = File.expand_path(File.join(destination, entry.read.strip))
               next
             end
             if entry.full_name =~ ignore_re
               Mixlib::Archive::Log.warn "ignoring entry #{entry.full_name}"
               next
             end
             dest ||= File.expand_path(File.join(destination, entry.full_name))
+            # Reject any entry (including @LongLink-derived paths) that resolves
+            # outside destination, closing the tar-slip / path traversal bypass.
+            unless dest == destination_root || dest.start_with?(destination_root + File::SEPARATOR)
+              Mixlib::Archive::Log.warn "ignoring entry #{entry.full_name}: resolves outside #{destination}"
+              dest = nil
+              next
+            end
             parent = File.dirname(dest)
             FileUtils.mkdir_p(parent)
 

spec/mixlib/tar_spec.rb

@@ -76,6 +76,50 @@
 
   end
 
+  describe "#extract" do
+    let(:test_root) { Dir.mktmpdir(nil) }
+    let(:archive_path) { File.join(test_root, "malicious.tar") }
+    let(:target) { File.join(test_root, "target") }
+    let(:outside_path) { File.join(test_root, "pwned") }
+
+    # Builds a tar with a "././@LongLink" header (GNU long-name extension)
+    # whose payload is a path-traversal string, followed by a regular entry
+    # that would land at that traversed path if unfiltered.
+    def write_longlink_tar(archive_path, longlink_target, payload)
+      File.open(archive_path, "wb") do |f|
+        writer = Gem::Package::TarWriter.new(f)
+        header = Gem::Package::TarHeader.new(
+          name: Mixlib::Archive::Tar::TAR_LONGLINK,
+          typeflag: "L",
+          size: longlink_target.bytesize,
+          prefix: "",
+          mode: 0o644
+        ).to_s
+        f.write(header)
+        f.write(longlink_target.ljust((longlink_target.bytesize / 512.0).ceil * 512, "\x00"))
+        writer.add_file_simple("innocent_name.txt", 0o644, payload.bytesize) { |io| io.write(payload) }
+        writer.close
+      end
+    end
+
+    it "does not write outside destination via a @LongLink path traversal payload" do
+      write_longlink_tar(archive_path, "../pwned", "pwned!")
+
+      described_class.new(archive_path).extract(target)
+
+      expect(File.exist?(outside_path)).to be false
+    end
+
+    it "still extracts entries with legitimate long names" do
+      long_name = "a" * 200
+      write_longlink_tar(archive_path, long_name, "hello")
+
+      described_class.new(archive_path).extract(target)
+
+      expect(File.read(File.join(target, long_name))).to eq("hello")
+    end
+  end
+
   describe "#is_tar_archive?" do
     let(:raw) { double(IO, closed?: true, rewind: 0, read: data) }
     context "oldgnu style header" do