fix Arbitrary file access during archive extraction ("Zip Slip")

[osiris-security]

mongo-tools/release/release.go

Lines 1527 to 1532 in f76a3ae

	for header, err := tarReader.Next(); err != io.EOF; header, err = tarReader.Next() {
	fmt.Printf("extracting %v\n", header.Name)
	check(err, "read from tar file")
	path := filepath.Join(dst, header.Name)

Extracting files from a malicious zip file, or similar type of archive, is at risk of directory traversal attacks if filenames from the archive are not properly validated. archive paths.

Fix the issue need to validate the header.Name field to ensure it does not contain directory traversal elements (..) or absolute paths. This can be achieved by:

1. Using filepath.Clean to normalize the path.
2. Verifying that the resulting path is within the intended destination directory (dst).

The fix involves:

• Cleaning the header.Name using filepath.Clean.
• Constructing the full path (path) and ensuring it is within the dst directory by checking that the cleaned path starts with the dst prefix.

Zip Slip Vulnerability