From 788418cff20a047a9f0124a02d465c8d2eeda2c7 Mon Sep 17 00:00:00 2001
From: Matthew Hooker <mwhooker@gmail.com>
Date: Fri, 25 May 2018 03:42:40 -0700
Subject: [PATCH] Add unit test to show that we handle tars safely

---
 .../decompress-tar/outside_parent.tar         | Bin 0 -> 10240 bytes
 post-processor/vagrant/virtualbox.go          |   8 ++++++++
 post-processor/vagrant/virtualbox_test.go     |  18 ++++++++++++++++++
 3 files changed, 26 insertions(+)
 create mode 100644 common/test-fixtures/decompress-tar/outside_parent.tar

diff --git a/common/test-fixtures/decompress-tar/outside_parent.tar b/common/test-fixtures/decompress-tar/outside_parent.tar
new file mode 100644
index 0000000000000000000000000000000000000000..f08df1e6560b1137d6103ab0968518339bb3566c
GIT binary patch
literal 10240
zcmeIxOAdlC5P;#XIYo_oC@t12cmvnSBanbKg7>#*OppZ|Bq8RX&9t;>r(c*bjPjy&
z;mu`Ytx!I!QewzQdw6A~lXo6I8Y5z(4^|s(wG}E({6-<wS_O^IeRO?#mr}HKpH)TE
zRO7|b*l#P#(R?}_-r?i(sOj=n=lflBsjpF21w~dldGZ2Ip5494gRPcKT|X3P)A}0r
zb3gX-%Z9#~?SJ1k-~Dfr*wX*Y<v9TX1Q0*~0R#|0009ILKmY**5I_I{1Q0*~0R#|0
R009ILKmY**5J2GH1)fUXI931v

literal 0
HcmV?d00001

diff --git a/post-processor/vagrant/virtualbox.go b/post-processor/vagrant/virtualbox.go
index 6b01a9c8c83..3efda5e9f3d 100644
--- a/post-processor/vagrant/virtualbox.go
+++ b/post-processor/vagrant/virtualbox.go
@@ -133,7 +133,15 @@ func DecompressOva(dir, src string) error {
 		if hdr == nil || err == io.EOF {
 			break
 		}
+		if err != nil {
+			return err
+		}
 
+		// We use the fileinfo to get the file name because we are not
+		// expecting path information as from the tar header. It's important
+		// that we not use the path name from the tar header without checking
+		// for the presence of `..`. If we accidentally allow for that, we can
+		// open ourselves up to a path traversal vulnerability.
 		info := hdr.FileInfo()
 
 		// Shouldn't be any directories, skip them
diff --git a/post-processor/vagrant/virtualbox_test.go b/post-processor/vagrant/virtualbox_test.go
index c3815ce770a..5082c9388a9 100644
--- a/post-processor/vagrant/virtualbox_test.go
+++ b/post-processor/vagrant/virtualbox_test.go
@@ -1,9 +1,27 @@
 package vagrant
 
 import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func TestVBoxProvider_impl(t *testing.T) {
 	var _ Provider = new(VBoxProvider)
 }
+
+func TestDecomressOVA(t *testing.T) {
+	td, err := ioutil.TempDir("", "pp-vagrant-virtualbox")
+	assert.NoError(t, err)
+	fixture := "../../common/test-fixtures/decompress-tar/outside_parent.tar"
+	err = DecompressOva(td, fixture)
+	assert.NoError(t, err)
+	_, err = os.Stat(filepath.Join(filepath.Base(td), "demo.poc"))
+	assert.Error(t, err)
+	_, err = os.Stat(filepath.Join(td, "demo.poc"))
+	assert.NoError(t, err)
+	os.RemoveAll(td)
+}