fix: optimized archive extraction path traversal checks

Author: cyberchen1995

example/go.mod

@@ -1,6 +1,6 @@
 module opensca-example
 
-go 1.20
+go 1.25
 
 require github.com/xmirrorsecurity/opensca-cli/v3 v3.0.2
 

opensca/walk/rar.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/xmirrorsecurity/opensca-cli/v3/opensca/logs"
 
@@ -42,15 +41,14 @@ func xrar(ctx context.Context, filter ExtractFileFilter, input, output string) b
 			break
 		}
 
-		fp := filepath.Join(output, fh.Name)
-		if fh.IsDir {
-			os.MkdirAll(fp, 0755)
+		fp, err := resolveExtractPath(output, fh.Name)
+		if err != nil {
+			logs.Warn(err)
 			continue
 		}
 
-		// avoid path traversal
-		if !strings.HasPrefix(fp, filepath.Clean(output)+string(os.PathSeparator)) {
-			logs.Warn("Invalid file path: %s", fp)
+		if fh.IsDir {
+			os.MkdirAll(fp, 0755)
 			continue
 		}
 

opensca/walk/tar.go

@@ -44,11 +44,9 @@ func xtar(ctx context.Context, filter ExtractFileFilter, input, output string) b
 			break
 		}
 
-		fp := filepath.Join(output, fh.Name)
-
-		// avoid zip slip
-		if !strings.HasPrefix(fp, filepath.Clean(output)+string(os.PathSeparator)) {
-			logs.Warn("Invalid file path: %s", fp)
+		fp, err := resolveExtractPath(output, fh.Name)
+		if err != nil {
+			logs.Warn(err)
 			continue
 		}
 

opensca/walk/zip.go

@@ -7,7 +7,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/xmirrorsecurity/opensca-cli/v3/opensca/common"
 	"github.com/xmirrorsecurity/opensca-cli/v3/opensca/logs"
@@ -40,17 +39,17 @@ func xzip(ctx context.Context, filter ExtractFileFilter, input, output string) b
 			continue
 		}
 
-		fp := filepath.Join(output, f.Name)
+		entryName := f.Name
 
 		if f.Flags == 0 {
 			gbk := mahonia.NewDecoder("gbk").ConvertString(f.Name)
 			_, cdata, _ := mahonia.NewDecoder("utf-8").Translate([]byte(gbk), true)
-			fp = filepath.Join(output, string(cdata))
+			entryName = string(cdata)
 		}
 
-		// avoid zip slip
-		if !strings.HasPrefix(fp, filepath.Clean(output)+string(os.PathSeparator)) {
-			logs.Warn("Invalid file path: %s", fp)
+		fp, err := resolveExtractPath(output, entryName)
+		if err != nil {
+			logs.Warn(err)
 			continue
 		}