evetest: Potential fix for code scanning alert no. 2391: Arbitrary file write extracting an archive containing symbolic links

[eriknordmark]

Potential fix for https://github.com/lf-edge/eve/security/code-scanning/2391

To fix this safely, validate every extracted output path (and symlink target path) against the destination directory using canonical, symlink-aware resolution before creating files/dirs/symlinks. Also avoid using path for OS filesystem paths; use path/filepath.

Best fix here (without changing intended behavior): in evetest/utils/tar.go, replace the simple pathBuilder with a secure resolver that:

1. Builds candidate path with filepath.Join.
2. Resolves the parent directory with filepath.EvalSymlinks (or destination for root parent).
3. Reconstructs final path from resolved parent + base name.
4. Verifies the final path is inside canonical destination via filepath.Rel and .. check.
5. For symlink targets, resolve relative to the symlink’s parent directory and enforce the same containment.

Then use this resolver in all three branches (TypeDir, TypeReg, TypeLink/TypeSymlink) and create symlink with validated link target and validated link path.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[christoph-zededa]

What about using https://pkg.go.dev/os#OpenRoot then you don't need these validation lambdas, do you?

[eriknordmark]

os.OpenRoot would replace the path resolution, yes — evetest is on go 1.25.2 and Root.OpenFile/Mkdir/Lstat/Remove/Symlink/Link are all there. It refuses the traversal this alert is about, including the interesting case: writing through a symlink already extracted into the destination (Create("link/x") where link points outside) fails with "path escapes from parent", so resolveArchivePath and isWithinDestination both go away.

Root.Symlink does not validate the link target though — I checked, and both Symlink("/etc/passwd", ...) and Symlink("../outside", ...) succeed and create the link. So the containment check on header.Linkname has to stay in some form; os.Root protects anything that later traverses through the Root, but the extracted tree is handed to tests that walk it with plain os calls.

Rewriting it that way is a clear improvement over the autofix. This being a Copilot autofix branch in the upstream repo, it needs a hand-written replacement rather than an amendment — I will open one.