[JENKINS-67063] Revert canonicalization of entries when untarring (#5900)

Co-authored-by: Daniel Beck <daniel-beck@users.noreply.github.com>
This commit is contained in:
Daniel BeckandDaniel Beck authored and GitHub committed 2021-11-09 08:07:18 +00:00
1 parent e8f2ae4e4c
commit 0accf411e9
1 file changed
+2 -3
+2 -3
View File
@@ -2831,14 +2831,13 @@ public final class FilePath implements SerializableOnlyOverRemoting {
* Supports large files > 10 GB since 1.627 when this was migrated to use commons-compress.
*/
private static void readFromTar(String name, File baseDir, InputStream in) throws IOException {
baseDir = baseDir.getCanonicalFile();
// TarInputStream t = new TarInputStream(in);
try (TarArchiveInputStream t = new TarArchiveInputStream(in)) {
TarArchiveEntry te;
while ((te = t.getNextTarEntry()) != null) {
File f = new File(baseDir, te.getName()).getCanonicalFile();
if (!f.toPath().startsWith(baseDir.toPath())) {
File f = new File(baseDir, te.getName());
if (!f.toPath().normalize().startsWith(baseDir.toPath())) {
throw new IOException(
"Tar " + name + " contains illegal file name that breaks out of the target directory: " + te.getName());
}