The updater extracts bundle tar.gz with tarfile.extractall without validating member paths.
Malicious or corrupted archives could write outside /var/tmp/pikit-update or overwrite system files.
Proposal
Implement a safe_extract helper that rejects members whose names are absolute, contain .., or escape the intended target directory.
Use it in _install_manifest when unpacking bundle.tar.gz.
Add unit tests covering allowed/blocked entries.
Acceptance
Extracting a tar with ../ or absolute paths fails with a clear error and leaves state stable.
Normal bundles still install successfully.
Tests cover traversal cases.
Problem
- The updater extracts bundle tar.gz with tarfile.extractall without validating member paths.
- Malicious or corrupted archives could write outside /var/tmp/pikit-update or overwrite system files.
Proposal
- Implement a safe_extract helper that rejects members whose names are absolute, contain .., or escape the intended target directory.
- Use it in _install_manifest when unpacking bundle.tar.gz.
- Add unit tests covering allowed/blocked entries.
Acceptance
- Extracting a tar with ../ or absolute paths fails with a clear error and leaves state stable.
- Normal bundles still install successfully.
- Tests cover traversal cases.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
Proposal
Acceptance