vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-04-30 21:09:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

security: fix checksum grep anchoring and tar path traversal in github-auth.sh (#2213)

Browse source 
* security: fix checksum grep anchoring and tar path traversal in github-auth.sh

- Anchor grep with -F " ${tarball}" to prevent partial filename matches
  in checksum validation (e.g. foo.tar.gz matching foo.tar.gz.sig)
- Add pre-extraction validation rejecting tarballs with absolute paths
  or ../ traversal components (CWE-22), cross-platform (GNU + BSD tar)

Fixes #2211
Fixes #2212

Agent: security-auditor
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix: anchor checksum grep with two-space prefix and EOL to prevent partial match

Agent: pr-maintainer
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-03-05 05:41:48 -08:00 • committed by GitHub
parent 475a1772a7
commit 5dfb91b747
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
sh/shared/github-auth.sh
View file

@ -208,7 +208,7 @@ _download_and_install_gh() {
# Extract expected checksum for our tarball from the checksums file
local expected_checksum
expected_checksum=$(grep "${tarball}" "${checksums_file}" | awk '{print $1}')
expected_checksum=$(grep " ${tarball}"'$' "${checksums_file}" | awk '{print $1}')
if [[ -z "${expected_checksum}" ]]; then
log_error "Checksum for ${tarball} not found in checksums.txt"
rm -rf "${tmpdir}"
@ -228,6 +228,14 @@ _download_and_install_gh() {
log_info "SHA256 checksum verified for ${tarball}"
# Defense-in-depth: reject tarballs containing absolute paths or ../ traversal
# (CWE-22: path traversal). This check is cross-platform (GNU + BSD tar).
if tar -tzf "${tmpdir}/${tarball}" | grep -qE '(^/|\.\.)'; then
log_error "Tarball contains absolute paths or path traversal — refusing to extract"
rm -rf "${tmpdir}"
return 1
fi
tar -xzf "${tmpdir}/${tarball}" -C "${tmpdir}" || {
log_error "Failed to extract ${tarball}"
rm -rf "${tmpdir}"