Skip to content

Commit a4a387e

Browse files
emosbaughemosbaugh
authored
chore: CVE-2024-0406 remove github.com/mholt/archiver/v3 dependency (#1793)
1 parent 0b860b1 commit a4a387e

File tree

4 files changed

+235
-39
lines changed

4 files changed

+235
-39
lines changed

‎go.mod‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ require (
2727
github.com/longhorn/go-iscsi-helper v0.0.0-20210330030558-49a327fb024e
2828
github.com/manifoldco/promptui v0.9.0
2929
github.com/mattn/go-isatty v0.0.20
30-
github.com/mholt/archiver/v3 v3.5.1
3130
github.com/microsoft/go-mssqldb v1.8.0
3231
github.com/miekg/dns v1.1.65
3332
github.com/opencontainers/image-spec v1.1.1
@@ -163,7 +162,6 @@ require (
163162
github.com/BurntSushi/toml v1.4.0 // indirect
164163
github.com/Microsoft/go-winio v0.6.2 // indirect
165164
github.com/Microsoft/hcsshim v0.12.9 // indirect
166-
github.com/andybalholm/brotli v1.0.4 // indirect
167165
github.com/aws/aws-sdk-go v1.55.5 // indirect
168166
github.com/beorn7/perks v1.0.1 // indirect
169167
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
@@ -183,7 +181,6 @@ require (
183181
github.com/docker/go-connections v0.5.0 // indirect
184182
github.com/docker/go-metrics v0.0.1 // indirect
185183
github.com/docker/go-units v0.5.0 // indirect
186-
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
187184
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
188185
github.com/felixge/httpsnoop v1.0.4 // indirect
189186
github.com/fsnotify/fsnotify v1.8.0 // indirect
@@ -195,7 +192,6 @@ require (
195192
github.com/gogo/protobuf v1.3.2 // indirect
196193
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
197194
github.com/golang/protobuf v1.5.4 // indirect
198-
github.com/golang/snappy v0.0.4 // indirect
199195
github.com/google/btree v1.1.3 // indirect
200196
github.com/google/go-cmp v0.7.0 // indirect
201197
github.com/google/go-intervals v0.0.2 // indirect
@@ -229,14 +225,12 @@ require (
229225
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
230226
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
231227
github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d // indirect
232-
github.com/nwaples/rardecode v1.1.2 // indirect
233228
github.com/opencontainers/go-digest v1.0.0 // indirect
234229
github.com/opencontainers/runtime-spec v1.2.1
235230
github.com/opencontainers/selinux v1.11.1 // indirect
236231
github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
237232
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
238233
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
239-
github.com/pierrec/lz4/v4 v4.1.15 // indirect
240234
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
241235
github.com/prometheus/client_golang v1.20.5 // indirect
242236
github.com/prometheus/client_model v0.6.1 // indirect
@@ -250,7 +244,6 @@ require (
250244
github.com/tklauser/numcpus v0.6.1 // indirect
251245
github.com/ulikunitz/xz v0.5.12 // indirect
252246
github.com/vbatts/tar-split v0.11.7 // indirect
253-
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
254247
github.com/xlab/treeprint v1.2.0 // indirect
255248
github.com/yusufpapurcu/wmi v1.2.4 // indirect
256249
go.opencensus.io v0.24.0 // indirect

‎go.sum‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -677,8 +677,6 @@ github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3
677677
github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b/go.mod h1:1KcenG0jGWcpt8ov532z81sp/kMMUG485J2InIOyADM=
678678
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
679679
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
680-
github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
681-
github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
682680
github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
683681
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
684682
github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
@@ -814,9 +812,6 @@ github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDD
814812
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4=
815813
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
816814
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
817-
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 h1:iFaUwBSo5Svw6L7HYpRu/0lE3e0BaElwnNO1qkNQxBY=
818-
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
819-
github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
820815
github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
821816
github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
822817
github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
@@ -963,9 +958,7 @@ github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu
963958
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
964959
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
965960
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
966-
github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
967961
github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
968-
github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
969962
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
970963
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
971964
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -1135,15 +1128,11 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
11351128
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
11361129
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
11371130
github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
1138-
github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
1139-
github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
11401131
github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
11411132
github.com/klauspost/compress v1.15.11/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
11421133
github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
11431134
github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
1144-
github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
11451135
github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
1146-
github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
11471136
github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
11481137
github.com/klauspost/pgzip v1.2.6/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
11491138
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -1200,8 +1189,6 @@ github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/
12001189
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
12011190
github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
12021191
github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
1203-
github.com/mholt/archiver/v3 v3.5.1 h1:rDjOBX9JSF5BvoJGvjqK479aL70qh9DIpZCl+k7Clwo=
1204-
github.com/mholt/archiver/v3 v3.5.1/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
12051192
github.com/microsoft/go-mssqldb v1.8.0 h1:7cyZ/AT7ycDsEoWPIXibd+aVKFtteUNhDGf3aobP+tw=
12061193
github.com/microsoft/go-mssqldb v1.8.0/go.mod h1:6znkekS3T2vp0waiMhen4GPU1BiAsrP+iXHcE7a7rFo=
12071194
github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
@@ -1255,9 +1242,6 @@ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J
12551242
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
12561243
github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d h1:x3S6kxmy49zXVVyhcnrFqxvNVCBPb2KZ9hV2RBdS840=
12571244
github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d/go.mod h1:IuKpRQcYE1Tfu+oAQqaLisqDeXgjyyltCfsaoYN18NQ=
1258-
github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
1259-
github.com/nwaples/rardecode v1.1.2 h1:Cj0yZY6T1Zx1R7AhTbyGSALm44/Mmq+BAPc4B/p/d3M=
1260-
github.com/nwaples/rardecode v1.1.2/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
12611245
github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
12621246
github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
12631247
github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -1285,8 +1269,6 @@ github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rK
12851269
github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
12861270
github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
12871271
github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
1288-
github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
1289-
github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
12901272
github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
12911273
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
12921274
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
@@ -1413,8 +1395,6 @@ github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFA
14131395
github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
14141396
github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
14151397
github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
1416-
github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
1417-
github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
14181398
github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
14191399
github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
14201400
github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
@@ -1438,8 +1418,6 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHo
14381418
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
14391419
github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
14401420
github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
1441-
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
1442-
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
14431421
github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
14441422
github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
14451423
github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=

‎pkg/supportbundle/parse.go‎

Lines changed: 77 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
package supportbundle
22

33
import (
4+
"archive/tar"
5+
"compress/gzip"
46
"encoding/json"
57
"fmt"
6-
"io/ioutil"
8+
"io"
79
"os"
810
"path/filepath"
911
"regexp"
1012
"strings"
1113

12-
"github.com/mholt/archiver/v3"
1314
"github.com/pkg/errors"
1415
"github.com/replicatedhq/troubleshoot/pkg/constants"
1516
types "github.com/replicatedhq/troubleshoot/pkg/supportbundle/types"
@@ -109,12 +110,7 @@ func GetFilesContents(bundleArchive string, filenames []string) (map[string][]by
109110
}
110111
defer os.RemoveAll(bundleDir)
111112

112-
tarGz := archiver.TarGz{
113-
Tar: &archiver.Tar{
114-
ImplicitTopLevelFolder: false,
115-
},
116-
}
117-
if err := tarGz.Unarchive(bundleArchive, bundleDir); err != nil {
113+
if err := unarchive(bundleArchive, bundleDir); err != nil {
118114
return nil, errors.Wrap(err, "failed to unarchive")
119115
}
120116

@@ -155,7 +151,7 @@ func GetFilesContents(bundleArchive string, filenames []string) (map[string][]by
155151
continue
156152
}
157153
if trimmedRelPath == trimmedFileName {
158-
content, err := ioutil.ReadFile(path)
154+
content, err := os.ReadFile(path)
159155
if err != nil {
160156
return errors.Wrap(err, "failed to read file")
161157
}
@@ -173,3 +169,75 @@ func GetFilesContents(bundleArchive string, filenames []string) (map[string][]by
173169

174170
return files, nil
175171
}
172+
173+
// unarchive extracts a tar.gz archive to the specified destination directory
174+
func unarchive(archivePath, destDir string) error {
175+
// Open the archive file
176+
f, err := os.Open(archivePath)
177+
if err != nil {
178+
return errors.Wrap(err, "failed to open archive")
179+
}
180+
defer f.Close()
181+
182+
// Create a gzip reader
183+
gzr, err := gzip.NewReader(f)
184+
if err != nil {
185+
return errors.Wrap(err, "failed to create gzip reader")
186+
}
187+
defer gzr.Close()
188+
189+
// Create a tar reader
190+
tr := tar.NewReader(gzr)
191+
192+
// Extract each file from the archive
193+
for {
194+
header, err := tr.Next()
195+
if err == io.EOF {
196+
break // End of archive
197+
}
198+
if err != nil {
199+
return errors.Wrap(err, "failed to read tar header")
200+
}
201+
202+
// Skip if not a file
203+
if header.Typeflag != tar.TypeReg {
204+
continue
205+
}
206+
207+
// Prevent directory traversal attacks (gosec G305) by validating file paths
208+
// and ensuring they don't escape the destination directory
209+
sanitizedName := filepath.Clean(header.Name)
210+
if strings.HasPrefix(sanitizedName, "../") || strings.HasPrefix(sanitizedName, "/") {
211+
continue // Skip this file as it's trying to escape
212+
}
213+
214+
// Create the directory structure
215+
target := filepath.Join(destDir, sanitizedName)
216+
217+
// Ensure the target path is still within destDir
218+
if !strings.HasPrefix(filepath.Clean(target), filepath.Clean(destDir)) {
219+
continue // Skip this file as it's trying to escape
220+
}
221+
222+
dir := filepath.Dir(target)
223+
if err := os.MkdirAll(dir, 0755); err != nil {
224+
return errors.Wrap(err, "failed to create directory")
225+
}
226+
227+
// Create the file
228+
f, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR, header.FileInfo().Mode())
229+
if err != nil {
230+
return errors.Wrap(err, "failed to create file")
231+
}
232+
233+
// Copy the file data with size limit to prevent decompression bomb (gosec G110)
234+
const maxDecompressedFileSize = 100 * 1024 * 1024 // 100MB limit per file
235+
if _, err := io.Copy(f, io.LimitReader(tr, maxDecompressedFileSize)); err != nil {
236+
f.Close()
237+
return errors.Wrap(err, "failed to write file")
238+
}
239+
f.Close()
240+
}
241+
242+
return nil
243+
}

0 commit comments

Comments
 (0)