Merge 4e2c93d into 1b478bb

grafana · Feb 9, 2024 · 00f789b · 00f789b
2 parents 1b478bb + 4e2c93d
commit 00f789b
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/lib/testutils/untar.go b/lib/testutils/untar.go
@@ -38,9 +38,12 @@ func Untar(t *testing.T, fileSystem fsext.Fs, fileName string, destination strin
 			continue
 		}
 
-		// as long as this code in a test helper, we can safely
-		// omit G305: File traversal when extracting zip/tar archive
-		target := filepath.Join(destination, header.Name) //nolint:gosec
+		fileName := header.Name
+		if !filepath.IsLocal(fileName) {
+			return errors.New("tar file contains non-local file names")
+		}
+
+		target := filepath.Join(destination, filepath.Clean(fileName))
 
 		switch header.Typeflag {
 		case tar.TypeDir: