Fix deb.go symlink validation

egibs · egibs · commit 5e6412dab917 · 2024-12-31T15:37:13.000-06:00
Signed-off-by: egibs &lt;20933572+egibs@users.noreply.github.com&gt;
diff --git a/pkg/archive/deb.go b/pkg/archive/deb.go
@@ -88,7 +88,7 @@ func ExtractDeb(ctx context.Context, d, f string) error {
 			if err != nil {
 				return fmt.Errorf("failed to evaluate symlink: %w", err)
 			}
-			if !IsValidPath(target, d) {
+			if !IsValidPath(linkReal, d) {
 				return fmt.Errorf("symlink points outside temporary directory: %s", linkReal)
 			}
 			if err := os.Symlink(header.Linkname, target); err != nil {

Original file line number	Diff line number	Diff line change
`@@ -88,7 +88,7 @@ func ExtractDeb(ctx context.Context, d, f string) error {`
`88`	`88`	`if err != nil {`
`89`	`89`	`return fmt.Errorf("failed to evaluate symlink: %w", err)`
`90`	`90`	`}`
`91`		`- if !IsValidPath(target, d) {`
	`91`	`+ if !IsValidPath(linkReal, d) {`
`92`	`92`	`return fmt.Errorf("symlink points outside temporary directory: %s", linkReal)`
`93`	`93`	`}`
`94`	`94`	`if err := os.Symlink(header.Linkname, target); err != nil {`