Merge commit from fork

The file store unpack path (pushDir -> extractTarDirectory) validated
symlink targets only lexically and skipped the parent-symlink check for
root-level entries, then wrote regular files with O_CREATE|O_TRUNC and no
O_NOFOLLOW. A malicious unpack layer could plant a chain of symlinks whose
lexical target stays inside the extraction root but whose kernel-resolved
target is an arbitrary absolute path, then write through it with a
same-named regular-file entry, creating or overwriting files outside the
store working directory under the default AllowPathTraversalOnWrite=false.

Fix:
- writeFile removes a pre-existing terminal symlink before opening, so a
  regular-file entry can never be written through a link left by an
  earlier entry.
- extractTarDirectory re-verifies containment with symlinks resolved via
  the existing checkSymlinkEscape helper, matching the pushFile path.

Adds a regression test reproducing the symlink-chain escape.

Signed-off-by: Terry Howe <terrylhowe@gmail.com>

Author: TerryHowe

content/file/file_unix_test.go

@@ -18,12 +18,16 @@ limitations under the License.
 package file
 
 import (
+	"archive/tar"
 	"bytes"
+	"compress/gzip"
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"oras.land/oras-go/v2"
 )
@@ -472,3 +476,107 @@ func TestStore_Dir_OverwriteSymlink_RemovalFailed(t *testing.T) {
 		t.Fatal("error calling Chmod(), error =", err)
 	}
 }
+
+// TestStore_Dir_SymlinkChainEscape reproduces GHSA-m37j-52j7-pjw7: a malicious
+// unpack layer plants a chain of symlinks whose lexical target stays inside the
+// extraction root but whose kernel-resolved target is an absolute path outside
+// it, then writes a regular file with the same name to write through the link.
+// The write must be contained inside the store's working directory.
+func TestStore_Dir_SymlinkChainEscape(t *testing.T) {
+	workDir := t.TempDir()
+	// attacker's target lives outside the store working directory
+	outsideDir := t.TempDir()
+	outsidePath := filepath.Join(outsideDir, "PWNED")
+
+	const title = "out"
+	baseAbs := filepath.Join(workDir, title)
+	depth := len(strings.Split(strings.Trim(filepath.ToSlash(baseAbs), "/"), "/"))
+
+	// build the malicious tar.gz
+	var buf bytes.Buffer
+	gzw := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gzw)
+
+	dirs := make([]string, depth)
+	for i := range dirs {
+		dirs[i] = "d"
+	}
+	for i := 1; i <= depth; i++ {
+		if err := tw.WriteHeader(&tar.Header{
+			Typeflag: tar.TypeDir,
+			Name:     title + "/" + strings.Join(dirs[:i], "/"),
+			Mode:     0o755,
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// "up" symlink at the bottom, resolving back to baseAbs
+	if err := tw.WriteHeader(&tar.Header{
+		Typeflag: tar.TypeSymlink,
+		Name:     title + "/" + strings.Join(dirs, "/") + "/up",
+		Linkname: strings.Repeat("../", depth-1) + "..",
+		Mode:     0o777,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	// "escape" symlink whose lexical target stays in-bounds but whose
+	// kernel-resolved target is outsidePath
+	escapeTarget := strings.Join(dirs, "/") + "/up/" + strings.Repeat("../", depth-1) + ".." + outsidePath
+	if err := tw.WriteHeader(&tar.Header{
+		Typeflag: tar.TypeSymlink,
+		Name:     title + "/escape",
+		Linkname: escapeTarget,
+		Mode:     0o777,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	// regular file with the same name, written through the symlink
+	payload := []byte("PWNED-BY-ORAS-TARSLIP")
+	if err := tw.WriteHeader(&tar.Header{
+		Typeflag: tar.TypeReg,
+		Name:     title + "/escape",
+		Mode:     0o644,
+		Size:     int64(len(payload)),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tw.Write(payload); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gzw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	blob := buf.Bytes()
+
+	desc := ocispec.Descriptor{
+		MediaType: ocispec.MediaTypeImageLayerGzip,
+		Digest:    digest.FromBytes(blob),
+		Size:      int64(len(blob)),
+		Annotations: map[string]string{
+			ocispec.AnnotationTitle: title,
+			AnnotationUnpack:        "true",
+		},
+	}
+
+	s, err := New(workDir)
+	if err != nil {
+		t.Fatal("Store.New() error =", err)
+	}
+	defer s.Close()
+	if s.AllowPathTraversalOnWrite {
+		t.Fatal("expected AllowPathTraversalOnWrite to default to false")
+	}
+
+	// Push may succeed (write contained inside the store) or fail, but under no
+	// circumstances may it write outside the working directory.
+	_ = s.Push(context.Background(), desc, bytes.NewReader(blob))
+
+	if _, err := os.Stat(outsidePath); err == nil {
+		t.Fatalf("path traversal: file written outside working dir at %s", outsidePath)
+	} else if !os.IsNotExist(err) {
+		t.Fatalf("unexpected error stat-ing %s: %v", outsidePath, err)
+	}
+}

content/file/utils.go

@@ -175,6 +175,15 @@ func extractTarDirectory(dirPath, dirName string, r io.Reader, buf []byte, prese
 		}
 		filePath := filepath.Join(dirPath, filePathRel)
 
+		// resolveRelToBase only performs lexical and per-component Lstat checks,
+		// which a chain of previously-extracted symlinks can bypass. Re-verify
+		// containment with symlinks fully resolved before mutating the
+		// filesystem, matching the check on the pushFile path.
+		// (GHSA-m37j-52j7-pjw7)
+		if err := checkSymlinkEscape(dirPath, filePath); err != nil {
+			return err
+		}
+
 		// Create content
 		switch header.Typeflag {
 		case tar.TypeReg:
@@ -281,6 +290,16 @@ func ensureLinkPath(baseAbs, baseRel, link, target string) (string, error) {
 
 // writeFile writes content to the file specified by the `path` parameter.
 func writeFile(path string, r io.Reader, perm os.FileMode, buf []byte) (err error) {
+	// os.OpenFile follows a terminal symlink, so a regular-file entry whose
+	// path was already created as a symlink by an earlier archive entry would
+	// be written through that link, landing outside the extraction root
+	// (GHSA-m37j-52j7-pjw7). Remove any such symlink first so the content is
+	// written to a regular file at path itself.
+	if fi, err := os.Lstat(path); err == nil && fi.Mode()&os.ModeSymlink != 0 {
+		if err := os.Remove(path); err != nil {
+			return err
+		}
+	}
 	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
 	if err != nil {
 		return err