improve handling of local vs POSIX paths - #37
Draft
thaJeztah wants to merge 4 commits into
Draft
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #37 +/- ##
==========================================
- Coverage 66.35% 65.27% -1.08%
==========================================
Files 42 42
Lines 2027 2036 +9
==========================================
- Hits 1345 1329 -16
- Misses 497 533 +36
+ Partials 185 174 -11 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Member
Author
|
path too long? |
|
|
||
| // #nosec G305 -- The joined path is checked for path traversal. | ||
| dstPath := filepath.Join(dest, hdr.Name) | ||
| dstPath := filepath.Join(dest, filepath.FromSlash(hdr.Name)) |
| // such hardlinks can be resolved. | ||
| if strings.HasPrefix(hdr.Name, WhiteoutLinkDir) && hdr.Typeflag == tar.TypeReg { | ||
| basename := filepath.Base(hdr.Name) | ||
| basename := path.Base(hdr.Name) |
| // This keeps "..\" as-is, but normalizes "\..\" to "\". | ||
| hdr.Name = filepath.Clean(hdr.Name) | ||
| // This keeps "../" as-is, but normalizes "/../" to "/". | ||
| hdr.Name = path.Clean(hdr.Name) |
|
|
||
| // Normalize name, for safety and for a simple is-root check | ||
| hdr.Name = filepath.Clean(hdr.Name) | ||
| hdr.Name = path.Clean(hdr.Name) |
| // #nosec G305 -- The joined path is guarded against path traversal. | ||
| path := filepath.Join(dest, hdr.Name) | ||
| rel, err := filepath.Rel(dest, path) | ||
| dstPath := filepath.Join(dest, filepath.FromSlash(hdr.Name)) |
thaJeztah
marked this pull request as draft
July 15, 2026 12:23
thaJeztah
force-pushed
the
more_posix
branch
4 times, most recently
from
July 15, 2026 14:54
3d3db1b to
385e837
Compare
The code used os.PathSeparator to detect if the Tar-header was not for a directory, but Tar headers use POSIX (forward-slashes), so this would fail on Windows. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update the parent path handling to use the right conventions (forward-slashes) before constructing a local path. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ExportChanges: use POSIX / Unix conventions for Tar operations
The Change.Path field holds a local path, but it was used to set
the Tar.Name field.
Convert the path to a POSIX / Unix path before setting. Also explicitly
convert the archive-path to a POSIX path when calling addTarFile, and
explicitly strip a leading
/(if present), instead of the firstcharacter.
createImpliedDirectories: fix directory detection and path handling
The code used os.PathSeparator to detect if the Tar-header was not for
a directory, but Tar headers use POSIX (forward-slashes), so this would
fail on Windows.
While updating, also update the parent path handling to use the right
conventions (forward-slashes) before constructing a local path.
RebaseArchiveEntries: use POSIX / Unix paths
This is mostly defense-in-depth; RebaseArchiveEntries is manipulating
the Tar headers, which use POSIX / Unix paths; convert the given paths
on the way in.