Harden absolute-path tar restore against poisoned cache entries #3

New issue

Closed

opened 2026-06-16 17:54:52 +00:00 by stephen · 0 comments

stephen commented

2026-06-16 17:54:52 +00:00

Owner

Why

cache-action restores archives with tar -xpP, preserving absolute paths. That matches home-dir cache behavior, but a poisoned cache object can write outside the requested cache paths.

Verified

src/lib/tar.js uses tar -xpP -f - during restore.
SECURITY.md documents absolute-path preservation; no allowlist enforcement is visible.
No existing cache-action issues are filed.

Build

Validate archive entries before extraction against the requested path allowlist.
Reject symlinks/hardlinks/device entries that escape allowed paths.
Add malicious archive tests covering absolute paths and .. traversal.

## Why cache-action restores archives with `tar -xpP`, preserving absolute paths. That matches home-dir cache behavior, but a poisoned cache object can write outside the requested cache paths. ## Verified - `src/lib/tar.js` uses `tar -xpP -f -` during restore. - `SECURITY.md` documents absolute-path preservation; no allowlist enforcement is visible. - No existing cache-action issues are filed. ## Build - Validate archive entries before extraction against the requested path allowlist. - Reject symlinks/hardlinks/device entries that escape allowed paths. - Add malicious archive tests covering absolute paths and `..` traversal.

stephen added the

opportunity

labels

2026-06-16 17:54:52 +00:00

stephen referenced this issue from a commit

2026-06-16 23:30:16 +00:00

Confine cache restore to the requested paths (#3)

stephen referenced this issue

2026-06-16 23:30:24 +00:00

Confine cache restore to the requested paths (#3) #6

stephen referenced this issue from a commit

2026-06-16 23:36:03 +00:00