[klauspost]

When self-extractor is extracting files from TAR validate that symlinks remains inside the destination.

Executables are already expected to be trusted and since they are embedded with the archive, so there really is no breach of trust.

This change is mainly to discourage false/pointless AI reports.

Summary by CodeRabbit

• Bug Fixes
  • Improved archive extraction safety by preventing path traversal through links.
  • Symlinks now keep absolute targets or resolve relative targets safely within the extracted directory.
  • Hard links are now checked before creation to ensure they cannot point outside the destination.
  • Tightened path validation to more reliably detect when a path escapes the extraction root.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 81c0571d-79a6-4ced-9a32-2ef2a25ab345

📥 Commits

Reviewing files that changed from the base of the PR and between bd9228c and eaf125d.

📒 Files selected for processing (1)

• s2/cmd/_s2sx/_unpack/main.go

---

📝 Walkthrough

Walkthrough

Path traversal protections are added to tar extraction in the s2sx unpack tool. Symlink targets are now resolved relative to the symlink's directory and validated against the destination root. Hardlink targets are validated with checkPath. The checkPath helper is rewritten using a filepath.Rel-based within containment check.

Changes

Path Traversal Hardening in Tar Extraction

Layer / File(s)	Summary
within/checkPath containment helper s2/cmd/_s2sx/_unpack/main.go	checkPath is rewritten to delegate to a new within helper that uses filepath.Rel and a separator-aware prefix check, replacing the prior naive string-prefix match.
Symlink and hardlink target validation s2/cmd/_s2sx/_unpack/main.go	tar.TypeSymlink now resolves the link target relative to the symlink directory and rejects targets outside dst via within; tar.TypeLink now calls checkPath on header.Linkname before creating the hardlink.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main symlink-target safety change in the extractor.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch s2sx-tar-paths

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}