#6542 fix(flytectl): arbitrary file access during archive extraction tempDir Pull request opened by odaysec flyte/flytectl/pkg/filesystemutils/file_system_utils.go Line 31 in</flyteorg/flyte/commit/cfcea4dd8181e038bc4e4de2d0c0021b1eab02d9|cfcea4d> | header, err := tarReader.Next() | | ------------------------------- | flyte/flytectl/pkg/filesystemutils/file_system_utils.go Lines 43 to 48 in</flyteorg/flyte/commit/cfcea4dd8181e038bc4e4de2d0c0021b1eab02d9|cfcea4d> | if err := os.Mkdir(header.Name, 0755); err != nil { | | --------------------------------------------------------------------- | | return err | | } | | case tar.TypeReg: | | fmt.Printf("Creating Flyte configuration file at: %s\n", destination) | | outFile, err := os.Create(destination) | flyte/flytectl/cmd/register/register_util.go Lines 593 to 602 in</flyteorg/flyte/commit/cfcea4dd8181e038bc4e4de2d0c0021b1eab02d9|cfcea4d> | header, err := tarReader.Next() | | ------------------------------------------------------------ | | switch { | | case err == io.EOF: | | return unarchivedFiles, nil | | case err != nil: | | return unarchivedFiles, err | | } | | // Location to untar. FilePath couldn't be used here due to, | | // G305: File traversal when extracting zip archive | | target := tempDir + "/" + header.Name | Extracting files from a malicious zip file, or similar type of archive, is at risk of directory traversal attacks if filenames from the archive are not properly validated. archive paths. zip archives contain archive entries representing each file in the archive. These entries include a file path for the entry, but these file paths are not restricted and may contain unexpected special elements such as the directory traversal element (..). If these file paths are used to create a filesystem path, then a file operation may happen in an unexpected location. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files. fix the issue, we need to validate the

header.Name

field to ensure it does not contain directory traversal elements like

..

and that it resolves to a path within the intended destination directory. This can be achieved by constructing the full path using

filepath.Join(destination, header.Name)

and then checking that the resulting path is within the

destination

directory using

filepath.Rel

or similar methods. fix: • Construct the full path for each archive entry using

filepath.Join(destination, header.Name)

. • Use

filepath.Rel

to ensure the resulting path is within the

destination

directory. • Reject any paths that attempt to traverse outside the

destination

directory. • Using

filepath.Clean

to normalize the

header.Name

path. • Constructing the

target

path using

filepath.Join(tempDir, cleanedName)

to ensure proper path joining. • Verifying that the resulting

target

path is within

tempDir

by checking that it has the

tempDir

prefix. This approach ensures that malicious paths in the tar archive cannot escape the

tempDir

directory. ## Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. ## Related PRs ## Docs link https://bito.ai#summarystart| ### Summary by Bito This pull request addresses a critical security vulnerability related to directory traversal attacks by implementing robust validation of file paths during file extraction. These changes enhance the safety of the file extraction process in the Flyte control tool. flyteorg/flyte