What
The backslash normalization in the tar member path-traversal guard (binary-upgrade.ts, around line 236) is unreachable.
The guard normalizes \ to / in listed archive members so a Windows-style traversal such as ..\evil is caught. But GNU tar escapes backslashes in -tzf output: a member stored as ..\evil is listed as ..\evil. Normalizing that yields ..//evil, which matches none of the three guard conditions.
Impact
Low in practice — the primary ../ check still catches POSIX-style traversal, which is what real archives use, and archgate's own release artifacts are trusted. But the branch is dead code that reads as protection it does not provide, so a future reader may reasonably believe backslash traversal is handled when it is not.
How it was found
Discovered while covering the tar path-traversal guard for #522 phase 3. Verified empirically against real GNU tar output rather than inferred from reading: the crafted archive lists and extracts correctly, all four unsafe entries trip the guard through the production predicate, and the backslash row is the only one that does not — it is documented as deliberately absent from the test table with this reason.
Suggested fix
Either unescape tar's output before normalizing (handling \ -> \), or drop the backslash branch and state in a comment that tar output is POSIX-separated so only ../ needs checking. Whichever is chosen, the test table should gain the corresponding row.
Found during #522 phase 3 (#553).
What
The backslash normalization in the tar member path-traversal guard (
binary-upgrade.ts, around line 236) is unreachable.The guard normalizes
\to/in listed archive members so a Windows-style traversal such as..\evilis caught. But GNU tar escapes backslashes in-tzfoutput: a member stored as..\evilis listed as..\evil. Normalizing that yields..//evil, which matches none of the three guard conditions.Impact
Low in practice — the primary
../check still catches POSIX-style traversal, which is what real archives use, and archgate's own release artifacts are trusted. But the branch is dead code that reads as protection it does not provide, so a future reader may reasonably believe backslash traversal is handled when it is not.How it was found
Discovered while covering the tar path-traversal guard for #522 phase 3. Verified empirically against real GNU tar output rather than inferred from reading: the crafted archive lists and extracts correctly, all four unsafe entries trip the guard through the production predicate, and the backslash row is the only one that does not — it is documented as deliberately absent from the test table with this reason.
Suggested fix
Either unescape tar's output before normalizing (handling
\->\), or drop the backslash branch and state in a comment that tar output is POSIX-separated so only../needs checking. Whichever is chosen, the test table should gain the corresponding row.Found during #522 phase 3 (#553).