Path traversal bug in unzip.go in functions extractTar and extractFile

[eqawasm]

Impact:

The latest version of arcat v1.3.1 has a path traversal vulnerability that allows the attacker to create or write to files outside the current directory for both .zip and .tar archives.

How to reproduce:

wget https://github.com/please-build/arcat/archive/refs/tags/v1.3.1.tar.gz 
tar -xzf v1.3.1.tar.gz
cd arcat-1.3.1/
go build -o arcat  main.go
# place pocpoc.zip in this directory
./arcat extract pocpoc.zip

# verify attack worked
cat ../poc/testtest.txt

rm -r ../poc/

# place pocpoc.tar in this directory
./arcat extract pocpoc.tar
# verify attack worked
cat ../poc/testtest.txt

Root cause:

The root cause is a missing sanitization function that prevents path traversal before reaching sink functions (os.OpenFile line 112) in extractTar and (os.OpenFile line 177) in extractFile.

Proposed fix:

I have created PR for a proposed fix that ensures the extraction of archive files inside the intended directory.

PoC image:
Extract poc.zip to obtain pocpoc.tar and pocpoc.zip: poc.zip