From f42fe0fc63c9cab33cce361bde16c12ac035efa4 Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Thu, 7 Jun 2018 18:15:50 +0200
Subject: [PATCH] [JENKINS-51777] Don't let tar entries escape target dir

(cherry picked from commit 7438abb88fc7d9bbd5f2b265e8fb191179a3c553)
---
 core/src/main/java/hudson/FilePath.java | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/core/src/main/java/hudson/FilePath.java b/core/src/main/java/hudson/FilePath.java
index 051a3561ba..7ec95e032f 100644
--- a/core/src/main/java/hudson/FilePath.java
+++ b/core/src/main/java/hudson/FilePath.java
@@ -2447,6 +2447,10 @@ public final class FilePath implements Serializable {
             TarArchiveEntry te;
             while ((te = t.getNextTarEntry()) != null) {
                 File f = new File(baseDir, te.getName());
+                if (!f.toPath().normalize().startsWith(baseDir.toPath())) {
+                    throw new IOException(
+                            "Tar " + name + " contains illegal file name that breaks out of the target directory: " + te.getName());
+                }
                 if (te.isDirectory()) {
                     mkdirs(f);
                 } else {