astronomer / astro-cli / 37869476528

45%

Build Type

push

github

Committed by web-flow

Commit Message

Constrain template extraction to the destination directory (#2220)

Reject tar entries that escape the template destination

astro dev init --from-template extracted a downloaded tarball by joining each
header name onto the destination with no containment check, so an entry with
../ segments or an absolute path could write files outside the project
directory (Zip-Slip). Add a check that every entry resolves inside the
destination, and reject symlink and hardlink entries outright since their
targets could point elsewhere. The real template registry contains only
regular files and directories, so rejecting links breaks nothing. Tests cover
a ../ escape, an absolute path, a symlink, and a normal archive that still
extracts.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

31 of 39 new or added lines in 1 file covered. (79.49%)

1 existing line in 1 file now uncovered.

27011 of 60126 relevant lines covered (44.92%)

9.68 hits per line