trying to fix the issue

PatrickLaabs · Mar 4, 2024 · 4a418ae · 4a418ae
1 parent e547ba4
commit 4a418ae
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/pkg/cluster/internal/logs/logs.go b/pkg/cluster/internal/logs/logs.go
@@ -23,6 +23,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 
 	"github.com/alessio/shellescape"
 
@@ -61,6 +62,11 @@ func untar(logger log.Logger, r io.Reader, dir string) (err error) {
 	for {
 		f, err := tr.Next()
 
+		if strings.Contains(f.Name, "..") {
+			logger.Warnf("Skipping potentially unsafe path: %s", f.Name)
+			continue // Skip this file
+		}
+
 		switch {
 		case err == io.EOF:
 			// drain the reader, which may have trailing null bytes