rasterstate/upload-artifact-action
2
0
Fork 0
Code Issues 1 Pull requests Activity Actions

[security] Harden tar extraction against traversal, link escape, and zip bombs #4

Merged
stephen merged 1 commit from fix/3-extract-tar-safety into main 2026-06-23 22:15:10 +00:00
Conversation 0 Commits 1 Files changed 2 +561 -7
stephen commented 2026-06-23 20:55:38 +00:00
Owner
Copy link

Closes #3.

Why: extractArchive did a raw tar -xf with no zip-slip / symlink / size-cap protection. download-artifact has this hardening; upload's copy drifted. Fixed before it gets wired into an extraction path.

  • Walk every tar header before writing a byte; reject entries that resolve outside the destination (../, absolute paths), symlink/hardlink escapes, and special files (device/fifo).
  • Cap total uncompressed bytes and entry count (env-overridable, defaults 10 GiB / 100k); fail closed on a bomb.
  • Strip setuid/setgid bits from extracted files/dirs.
  • A bad archive leaves the destination untouched (validation precedes extraction).
  • 233 lines of tests covering each rejection path.

Note: carries a 'keep in sync with download-artifact-action' comment; the two extraction paths should be unified later to prevent re-drift.

Testing: tests/artifact-tar.test.js + repo CI.

DO NOT MERGE: security-sensitive; lead/operator review.

Closes #3. Why: extractArchive did a raw `tar -xf` with no zip-slip / symlink / size-cap protection. download-artifact has this hardening; upload's copy drifted. Fixed before it gets wired into an extraction path. - Walk every tar header before writing a byte; reject entries that resolve outside the destination (../, absolute paths), symlink/hardlink escapes, and special files (device/fifo). - Cap total uncompressed bytes and entry count (env-overridable, defaults 10 GiB / 100k); fail closed on a bomb. - Strip setuid/setgid bits from extracted files/dirs. - A bad archive leaves the destination untouched (validation precedes extraction). - 233 lines of tests covering each rejection path. Note: carries a 'keep in sync with download-artifact-action' comment; the two extraction paths should be unified later to prevent re-drift. Testing: tests/artifact-tar.test.js + repo CI. DO NOT MERGE: security-sensitive; lead/operator review.
Harden artifact tar extraction
All checks were successful
test / e2e (pull_request) Successful in 23s
Details
test / unit (pull_request) Successful in 23s
Details
6800a8ac67
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/upload-artifact-action!4
No description provided.