Make symlink extraction in UntarNested conditional

Add an allowSymlinks parameter to UntarNested so callers can opt in to
extracting symlinks from a tarball. When disabled, a symlink entry
returns an error instead of being created.

Wire a --symlinks flag (default false) into the oci install command,
passing it through to UntarNested. System installers (go, node,
actions_runner, registry, containerd) pass true to preserve existing
behaviour for tarballs that contain symlinks.

Update existing tests and add a test for the disabled case.

Signed-off-by: Han Verstraete (OpenFaaS Ltd) <han@openfaas.com>

Author: welteki

cmd/oci/install.go

@@ -56,6 +56,7 @@ OCI image.`,
 
 	command.Flags().BoolP("gzipped", "g", false, "Is this a gzipped tarball?")
 	command.Flags().Bool("quiet", false, "Suppress progress output")
+	command.Flags().Bool("symlink", false, "Write symlinks when unpacking OCI image, only use with trusted sources")
 
 	// Hide the deprecated --path flag
 	command.Flags().MarkHidden("path")
@@ -68,6 +69,7 @@ OCI image.`,
 		version, _ := cmd.Flags().GetString("version")
 		gzipped, _ := cmd.Flags().GetBool("gzipped")
 		quiet, _ := cmd.Flags().GetBool("quiet")
+		allowSymlinks, _ := cmd.Flags().GetBool("symlink")
 		showProgress, _ := cmd.Flags().GetBool("progress")
 
 		if len(args) < 1 {
@@ -260,7 +262,7 @@ OCI image.`,
 				// When the alt-screen is active, suppress UntarNested's
 				// per-file logging so it doesn't corrupt the live frame.
 				untarQuiet := quiet || (tty && renderLive)
-				if uErr := archive.UntarNested(tarFile, installPath, gzipped, untarQuiet); uErr != nil {
+				if uErr := archive.UntarNested(tarFile, installPath, gzipped, untarQuiet, allowSymlinks); uErr != nil {
 					workErr = fmt.Errorf("failed to untar %s: %w", tempFile.Name(), uErr)
 				}
 			}

cmd/system/actions_runner.go

@@ -100,7 +100,7 @@ func MakeInstallActionsRunner() *cobra.Command {
 		fmt.Printf("Unpacking Actions Runner to: %s\n", path.Join(installPath, "actions-runner"))
 
 		if err := spinWhile("Unpacking Actions Runner", func() error {
-			return archive.UntarNested(f, installPath, true, true)
+			return archive.UntarNested(f, installPath, true, true, true)
 		}); err != nil {
 			return err
 		}

cmd/system/containerd.go

@@ -120,7 +120,7 @@ func MakeInstallContainerd() *cobra.Command {
 		tempDirName := os.TempDir() + "/containerd"
 
 		if err := spinWhile("Unpacking containerd", func() error {
-			return archive.UntarNested(f, tempDirName, true, true)
+			return archive.UntarNested(f, tempDirName, true, true, true)
 		}); err != nil {
 			return err
 		}

cmd/system/go.go

@@ -96,7 +96,7 @@ func MakeInstallGo() *cobra.Command {
 		fmt.Printf("Unpacking Go to: %s\n", path.Join(installPath, "go"))
 
 		if err := spinWhile("Unpacking Go", func() error {
-			return archive.UntarNested(f, installPath, true, true)
+			return archive.UntarNested(f, installPath, true, true, true)
 		}); err != nil {
 			return err
 		}

cmd/system/node.go

@@ -149,7 +149,7 @@ func MakeInstallNode() *cobra.Command {
 			fmt.Printf("Unpacking binaries to: %s\n", tempUnpackPath)
 		}
 		if err = spinWhile("Unpacking Node.js", func() error {
-			return archive.UntarNested(f, tempUnpackPath, true, true)
+			return archive.UntarNested(f, tempUnpackPath, true, true, true)
 		}); err != nil {
 			return err
 		}

cmd/system/registry.go

@@ -135,7 +135,7 @@ func MakeInstallRegistry() *cobra.Command {
 			tempDirName := fmt.Sprintf("%s/%s", os.TempDir(), toolName)
 			defer os.RemoveAll(tempDirName)
 			if err := spinWhile("Unpacking "+toolName, func() error {
-				return archive.UntarNested(f, tempDirName, true, true)
+				return archive.UntarNested(f, tempDirName, true, true, true)
 			}); err != nil {
 				return err
 			}

pkg/archive/untar_nested.go

@@ -13,14 +13,16 @@ import (
 )
 
 // UntarNested reads the gzip-compressed tar file from r and writes it into dir.
+// When allowSymlinks is false, any symlink entry in the archive causes an
+// error; when true, symlinks are extracted subject to containment checks.
 // Copyright 2017 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
-func UntarNested(r io.Reader, dir string, gzipped, quiet bool) error {
-	return untarNested(r, dir, gzipped, quiet)
+func UntarNested(r io.Reader, dir string, gzipped, quiet, allowSymlinks bool) error {
+	return untarNested(r, dir, gzipped, quiet, allowSymlinks)
 }
 
-func untarNested(r io.Reader, dir string, gzipped, quiet bool) (err error) {
+func untarNested(r io.Reader, dir string, gzipped, quiet, allowSymlinks bool) (err error) {
 	t0 := time.Now()
 	nFiles := 0
 	madeDir := map[string]bool{}
@@ -148,6 +150,9 @@ func untarNested(r io.Reader, dir string, gzipped, quiet bool) (err error) {
 			}
 			madeDir[abs] = true
 		case mode.Type() == os.ModeSymlink:
+			if !allowSymlinks {
+				return fmt.Errorf("tar file entry %s is a symlink, but symlink extraction is disabled", f.Name)
+			}
 			parent := filepath.Dir(abs)
 			if !madeDir[parent] {
 				if err := assertExistingPrefixWithinRoot(cleanDir, parent); err != nil {

pkg/archive/untar_nested_test.go

@@ -60,7 +60,7 @@ func Test_UntarNested_RejectsAbsoluteSymlinkWriteThrough(t *testing.T) {
 		{hdr: tar.Header{Name: "escape-link/escape.txt", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("escaped\n")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatal("want error, got nil")
 	}
 
@@ -92,7 +92,7 @@ func Test_UntarNested_RejectsRelativeSymlinkWriteThrough(t *testing.T) {
 		{hdr: tar.Header{Name: "escape-link/escape.txt", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("escaped\n")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatal("want error, got nil")
 	}
 
@@ -121,7 +121,7 @@ func Test_UntarNested_RejectsChainedSymlinkEscape(t *testing.T) {
 		{hdr: tar.Header{Name: "hop1/hop2/outside/escape.txt", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("escaped\n")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatal("want error, got nil")
 	}
 
@@ -149,7 +149,7 @@ func Test_UntarNested_RejectsPlantedEscapingSymlink(t *testing.T) {
 		{hdr: tar.Header{Name: "hop1/hop2", Typeflag: tar.TypeSymlink, Linkname: "..", Mode: 0777}},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatal("want error, got nil")
 	}
 
@@ -188,7 +188,7 @@ func Test_UntarNested_RejectsSymlinkTargetViaPreExistingSymlink(t *testing.T) {
 		{hdr: tar.Header{Name: "planted", Typeflag: tar.TypeSymlink, Linkname: "safe/file", Mode: 0777}},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatalf("expected extraction to be rejected, got nil error")
 	}
 
@@ -213,7 +213,7 @@ func Test_UntarNested_AllowsValidNestedFiles(t *testing.T) {
 		{hdr: tar.Header{Name: "README.md", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("hello\n")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err != nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err != nil {
 		t.Fatalf("expected clean extraction, got: %v", err)
 	}
 	for _, rel := range []string{"bin/tool", "README.md"} {
@@ -238,7 +238,7 @@ func Test_UntarNested_AllowsWriteThroughInternalSymlink(t *testing.T) {
 		{hdr: tar.Header{Name: "link/file.txt", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("hello\n")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err != nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err != nil {
 		t.Fatalf("expected clean extraction with write through internal symlink, got: %v", err)
 	}
 	if _, err := os.Stat(filepath.Join(installDir, "subdir", "file.txt")); err != nil {
@@ -260,7 +260,7 @@ func Test_UntarNested_AllowsWriteThroughInternalSymlinkDir(t *testing.T) {
 		{hdr: tar.Header{Name: "link/newdir", Typeflag: tar.TypeDir, Mode: 0755}},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err != nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err != nil {
 		t.Fatalf("expected clean extraction with dir write-through internal symlink, got: %v", err)
 	}
 	if _, err := os.Stat(filepath.Join(installDir, "subdir", "newdir")); err != nil {
@@ -296,7 +296,7 @@ func Test_UntarNested_PreExistingSymlinkDoesNotCreateDirOutsideRoot(t *testing.T
 		{hdr: tar.Header{Name: "link/subdir/escape.txt", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("escaped\n")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatal("want error, got nil")
 	}
 
@@ -332,7 +332,7 @@ func Test_UntarNested_RejectsLeafSymlinkWriteThrough(t *testing.T) {
 		{hdr: tar.Header{Name: "evil", Typeflag: tar.TypeReg, Mode: 0644}, body: []byte("HACKED")},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err == nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err == nil {
 		t.Fatal("want error, got nil")
 	}
 
@@ -354,7 +354,7 @@ func Test_UntarNested_AllowsValidInternalSymlink(t *testing.T) {
 		{hdr: tar.Header{Name: "tool", Typeflag: tar.TypeSymlink, Linkname: "tool-v1", Mode: 0777}},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err != nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err != nil {
 		t.Fatalf("expected clean extraction with internal symlink, got: %v", err)
 	}
 	linkPath := filepath.Join(installDir, "tool")
@@ -381,7 +381,7 @@ func Test_UntarNested_CreatesParentDirForSymlink(t *testing.T) {
 		{hdr: tar.Header{Name: "nested/link", Typeflag: tar.TypeSymlink, Linkname: "tool-v1", Mode: 0777}},
 	})
 
-	if err := UntarNested(bytes.NewReader(data), installDir, false, true); err != nil {
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, true); err != nil {
 		t.Fatalf("expected clean extraction with on-demand parent dir for symlink, got: %v", err)
 	}
 	linkPath := filepath.Join(installDir, "nested", "link")
@@ -393,3 +393,25 @@ func Test_UntarNested_CreatesParentDirForSymlink(t *testing.T) {
 		t.Fatalf("expected %q to be a symlink", linkPath)
 	}
 }
+
+// When allowSymlinks is false, any symlink entry in the tar must be rejected,
+// even when the link target stays safely within root.
+func Test_UntarNested_RejectsSymlinkWhenDisabled(t *testing.T) {
+	installDir, err := os.MkdirTemp("", "arkade-untar-*")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(installDir)
+
+	data := buildTar(t, []tarEntry{
+		{hdr: tar.Header{Name: "tool-v1", Typeflag: tar.TypeReg, Mode: 0755}, body: []byte("bin\n")},
+		{hdr: tar.Header{Name: "tool", Typeflag: tar.TypeSymlink, Linkname: "tool-v1", Mode: 0777}},
+	})
+
+	if err := UntarNested(bytes.NewReader(data), installDir, false, true, false); err == nil {
+		t.Fatalf("expected error when extracting symlink with symlinks disabled, got nil")
+	}
+	if _, err := os.Lstat(filepath.Join(installDir, "tool")); err == nil {
+		t.Fatalf("expected symlink not to be created when symlinks disabled")
+	}
+}