Validate tar link targets in data_filter fallback (GHSA-p4qx-p8p6-4gjf)

[matteius]

Summary

Fixes GHSA-p4qx-p8p6-4gjf: a tar hardlink/symlink traversal in pipenv.patched.pip._internal.utils.unpacking.untar_file.

When tarfile.data_filter raised LinkOutsideDestinationError for a link member, untar_file fell back to tarfile.tar_filter on three specific CPython patch versions (3.9.17 / 3.10.12 / 3.11.4) that shipped with python/cpython#107845. The link-target containment check in CPython's _get_filtered_attrs lives inside the if for_data: branch, so tar_filter performs no containment validation. An attacker-controlled tarball with a hardlink whose linkname escapes the destination (e.g. ../../etc-passwd-shadow) would have its link materialized outside the install root, enabling cache pollution / overwrites of files outside the destination.

• New helper _tar_link_target_is_within(member, destination) re-implements the containment check data_filter is supposed to perform — resolves the link target relative to the destination (or, for symlinks, relative to the link's own directory), then confirms it stays inside via os.path.commonpath.
• The fallback in pip_filter now only routes to tar_filter when (a) we're on a buggy CPython patch version and (b) the link target is independently confirmed in-bounds. Otherwise the original LinkOutsideDestinationError is re-raised and untar_file wraps it in InstallationError, so the install fails closed.
• The change is mirrored in tasks/vendoring/patches/patched/pip_tarfile_link_safety.patch so it survives a re-vendor of pip.

Test plan

• New tests/unit/test_tar_link_safety.py (11 tests):
  • 8 unit tests for _tar_link_target_is_within — accepts in-bounds hardlinks/symlinks; rejects ../ traversal, deep ../../../ traversal, absolute paths, empty linknames, and non-link members.
  • 3 end-to-end tests on real tar archives, monkeypatching data_filter to simulate the buggy CPython behaviour: malicious hardlink rejected (no link materialised on disk, InstallationError raised); legitimate in-bounds hardlink still extracts; modern-CPython path also rejects malicious hardlink before the fallback runs.
• python -m pytest tests/unit -q — 434 passed, 0 new failures (one pre-existing unrelated failure on main).
• ruff check clean on the touched files.
• git apply --check confirmed pip_tarfile_link_safety.patch is byte-identical to the working-tree diff.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses GHSA-p4qx-p8p6-4gjf by ensuring that when tarfile.data_filter triggers the historical LinkOutsideDestinationError fallback on specific buggy CPython patch versions, link targets are independently validated to remain within the extraction destination before falling back to tarfile.tar_filter.

Changes:

• Add _tar_link_target_is_within() to re-check hardlink/symlink containment prior to using the permissive tar_filter fallback.
• Tighten the LinkOutsideDestinationError fallback logic to only allow fallback on affected CPython patch versions and only for in-bounds link targets; otherwise fail closed.
• Add a vendoring patch to preserve the fix across pip re-vendoring, plus new unit/regression tests for the helper and end-to-end extraction behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
pipenv/patched/pip/_internal/utils/unpacking.py	Adds link-target containment helper and gates the buggy-CPython tar_filter fallback on the helper returning in-bounds.
tests/unit/test_tar_link_safety.py	Introduces regression tests for helper behavior and extraction behavior under simulated buggy data_filter.
tasks/vendoring/patches/patched/pip_tarfile_link_safety.patch	Mirrors the unpacking.py changes as a vendoring patch to make the fix durable across updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.