Adds ability for symlinks to link to absolute paths

Removes dead code

Author: ForestEckhardt

vacation/vacation.go

@@ -195,18 +195,18 @@ func (ta TarArchive) Decompress(destination string) error {
 	})
 
 	for _, h := range symlinkHeaders {
+		evalPath := linknameFullPath(h.path, h.linkname)
+		// Don't use constucted link if the link is absolute
+		if filepath.IsAbs(h.linkname) {
+			evalPath = h.linkname
+		}
+
 		// Check to see if the file that will be linked to is valid for symlinking
-		_, err := filepath.EvalSymlinks(linknameFullPath(h.path, h.linkname))
+		_, err := filepath.EvalSymlinks(evalPath)
 		if err != nil {
 			return fmt.Errorf("failed to evaluate symlink %s: %w", h.path, err)
 		}
 
-		// // Check that the symlink is inside the destination directory
-		// err = checkExtractPath(h.name, destination)
-		// if err != nil {
-		// 	return err
-		// }
-
 		err = os.Symlink(h.linkname, h.path)
 		if err != nil {
 			return fmt.Errorf("failed to extract symlink: %s", err)
@@ -452,18 +452,18 @@ func (z ZipArchive) Decompress(destination string) error {
 	})
 
 	for _, h := range symlinkHeaders {
+		evalPath := linknameFullPath(h.path, h.linkname)
+		// Don't use constucted link if the link is absolute
+		if filepath.IsAbs(h.linkname) {
+			evalPath = h.linkname
+		}
+
 		// Check to see if the file that will be linked to is valid for symlinking
-		_, err := filepath.EvalSymlinks(linknameFullPath(h.path, h.linkname))
+		_, err := filepath.EvalSymlinks(evalPath)
 		if err != nil {
 			return fmt.Errorf("failed to evaluate symlink %s: %w", h.path, err)
 		}
 
-		// // Check that the symlink is inside the destination directory
-		// err = checkExtractPath(h.name, destination)
-		// if err != nil {
-		// 	return err
-		// }
-
 		err = os.Symlink(h.linkname, h.path)
 		if err != nil {
 			return fmt.Errorf("failed to unzip symlink: %w", err)

vacation/vacation_tar_test.go

@@ -260,33 +260,6 @@ func testVacationTar(t *testing.T, context spec.G, it spec.S) {
 				})
 			})
 
-			// context("when it tries to symlink that tries to link to a file outside of the directory", func() {
-			// 	var zipSlipSymlinkTar vacation.TarArchive
-
-			// 	it.Before(func() {
-			// 		var err error
-
-			// 		Expect(os.MkdirAll(filepath.Join(tempDir, "sub-dir"), os.ModePerm)).To(Succeed())
-			// 		Expect(os.WriteFile(filepath.Join(tempDir, "some-file"), nil, 0644)).To(Succeed())
-
-			// 		buffer := bytes.NewBuffer(nil)
-			// 		tw := tar.NewWriter(buffer)
-
-			// 		Expect(tw.WriteHeader(&tar.Header{Name: "symlink", Mode: 0755, Size: int64(0), Typeflag: tar.TypeSymlink, Linkname: filepath.Join("..", "some-file")})).To(Succeed())
-			// 		_, err = tw.Write([]byte{})
-			// 		Expect(err).NotTo(HaveOccurred())
-
-			// 		Expect(tw.Close()).To(Succeed())
-
-			// 		zipSlipSymlinkTar = vacation.NewTarArchive(bytes.NewReader(buffer.Bytes()))
-			// 	})
-
-			// 	it("returns an error", func() {
-			// 		err := zipSlipSymlinkTar.Decompress(filepath.Join(tempDir, "sub-dir"))
-			// 		Expect(err).To(MatchError(ContainSubstring(fmt.Sprintf("illegal file path %q: the file path does not occur within the destination directory", filepath.Join("..", "some-file")))))
-			// 	})
-			// })
-
 			context("when the symlink creation fails", func() {
 				var brokenSymlinkTar vacation.TarArchive
 

vacation/vacation_zip_test.go

@@ -228,38 +228,6 @@ func testVacationZip(t *testing.T, context spec.G, it spec.S) {
 				})
 			})
 
-			// context("when it tries to symlink that tries to link to a file outside of the directory", func() {
-			// 	var buffer *bytes.Buffer
-			// 	it.Before(func() {
-			// 		var err error
-
-			// 		Expect(os.MkdirAll(filepath.Join(tempDir, "sub-dir"), os.ModePerm)).To(Succeed())
-			// 		Expect(os.WriteFile(filepath.Join(tempDir, "some-file"), nil, 0644)).To(Succeed())
-
-			// 		buffer = bytes.NewBuffer(nil)
-			// 		zw := zip.NewWriter(buffer)
-
-			// 		header := &zip.FileHeader{Name: "symlink"}
-			// 		header.SetMode(0755 | os.ModeSymlink)
-
-			// 		symlink, err := zw.CreateHeader(header)
-			// 		Expect(err).NotTo(HaveOccurred())
-
-			// 		_, err = symlink.Write([]byte(filepath.Join("..", "some-file")))
-			// 		Expect(err).NotTo(HaveOccurred())
-
-			// 		Expect(zw.Close()).To(Succeed())
-
-			// 	})
-
-			// 	it("returns an error", func() {
-			// 		readyArchive := vacation.NewZipArchive(buffer)
-
-			// 		err := readyArchive.Decompress(filepath.Join(tempDir, "sub-dir"))
-			// 		Expect(err).To(MatchError(ContainSubstring(fmt.Sprintf("illegal file path %q: the file path does not occur within the destination directory", filepath.Join("..", "some-file")))))
-			// 	})
-			// })
-
 			context("when the symlink creation fails", func() {
 				var buffer *bytes.Buffer
 				it.Before(func() {