[security] extractArchive lacks the tar-safety hardening present in download-artifact #3

New issue

Closed

opened 2026-06-23 20:14:55 +00:00 by stephen · 0 comments

stephen commented

2026-06-23 20:14:55 +00:00

Owner

Autonomous security audit finding (HIGH, currently latent).

src/lib/artifact-tar.js:84-90 does a raw tar -xf with no zip-slip / symlink / size-cap protection. The equivalent download-artifact code (download-impl.js :92-408) has that hardening; upload's copy drifted and lacks it. It's exported + tested as if safe but not called in src/ yet — fix before it's wired into an extraction path. Port the download-side entry validation.

Autonomous security audit finding (HIGH, currently latent). `src/lib/artifact-tar.js:84-90` does a raw `tar -xf` with no zip-slip / symlink / size-cap protection. The equivalent download-artifact code (`download-impl.js` :92-408) has that hardening; upload's copy drifted and lacks it. It's exported + tested as if safe but not called in src/ yet — fix before it's wired into an extraction path. Port the download-side entry validation.

stephen referenced this issue from a pull request that will close it,

2026-06-23 20:55:38 +00:00

[security] Harden tar extraction against traversal, link escape, and zip bombs #4

stephen closed this issue

2026-06-23 22:15:10 +00:00