{"record":{"id":"f846c8e0e667f33e","repo":"xtekky/gpt4free","slug":"unsafe-path-in-archive-s","errorCode":null,"errorMessage":"unsafe path in archive: %s","messagePattern":"unsafe path in archive: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"g4f-go/download.go","lineNumber":312,"sourceCode":"\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\trel := hdr.Name\n\t\tif top != \"\" {\n\t\t\trel = strings.TrimPrefix(rel, top+\"/\")\n\t\t\trel = strings.TrimPrefix(rel, top)\n\t\t}\n\t\trel = strings.TrimPrefix(rel, \"/\")\n\t\trel = strings.TrimPrefix(rel, \"./\")\n\t\tname := filepath.Clean(rel)\n\t\tif name == \".\" || name == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif name == \"..\" || strings.HasPrefix(name, \"..\"+string(os.PathSeparator)) {\n\t\t\treturn fmt.Errorf(\"unsafe path in archive: %s\", hdr.Name)\n\t\t}\n\t\ttarget := filepath.Join(dest, name)\n\t\tif !strings.HasPrefix(target, filepath.Clean(dest)+string(os.PathSeparator)) {\n\t\t\treturn fmt.Errorf(\"unsafe path in archive: %s\", hdr.Name)\n\t\t}\n\n\t\tswitch hdr.Typeflag {\n\t\tcase tar.TypeDir:\n\t\t\tif err := os.MkdirAll(target, 0o755); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\tcase tar.TypeReg, tar.TypeRegA:\n\t\t\tif err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tout, err := os.OpenFile(target, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(hdr.Mode)&0o777)\n\t\t\tif err != nil {\n\t\t\t\treturn err","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/xtekky/gpt4free/blob/973504e1770928ed5fb82f43da528f441ad9ddc3/g4f-go/download.go#L294-L330","documentation":"extractRuntime's tar walker in g4f-go/download.go strips the top-level directory and leading '/'/'./' prefixes, then filepath.Clean's each entry name. This error fires when a cleaned relative name is exactly '..' or starts with '../' — a path traversal (zip-slip style) attempt that would write outside the extraction destination, so extraction is aborted.","triggerScenarios":"A runtime tarball containing entries like '../../etc/passwd' or 'top/../../../bin/sh' after top-dir stripping. In practice: a maliciously crafted or badly assembled archive, or an archive whose genuine layout includes parent references.","commonSituations":"Downloading runtimes from untrusted/mirrored URLs; supply-chain tampering (this guard is exactly what catches it); malformed archives produced by unusual build tooling.","solutions":["Do not extract this archive — delete the cached file and re-download from the official URL","Inspect the archive: tar -tf <cachePath> | grep -E '(^|/)\\.\\./' to list offending entries","Verify the manifest's sha256 pin is present and correct so tampered artifacts are caught before extraction","Report the artifact if the official source itself ships traversal paths"],"exampleFix":"# before\n# unsafe path in archive: top/../../evil.sh\n\n# after\ntar -tf .g4f-runtime/runtime-*.tar.gz | grep '\\.\\.'   # identify bad entries\nrm .g4f-runtime/runtime-*.tar.gz                        # discard\ncurl -L -o .g4f-runtime/runtime-*.tar.gz \"<official-url>\"  # re-fetch from trusted source","handlingStrategy":"validation","validationCode":"// scan a tar for traversal entries before extracting\nfunc tarIsSafe(path string) (bool, error) {\n    f, err := os.Open(path)\n    if err != nil { return false, err }\n    defer f.Close()\n    tr := tar.NewReader(f)\n    for {\n        hdr, err := tr.Next()\n        if err == io.EOF { return true, nil }\n        if err != nil { return false, err }\n        name := filepath.Clean(hdr.Name)\n        if name == \"..\" || strings.HasPrefix(name, \"..\") {\n            return false, nil\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := extractRuntime(binDir, cachePath); err != nil {\n    if strings.Contains(err.Error(), \"unsafe path in archive\") {\n        // quarantine the archive, alert: possible supply-chain tampering\n    }\n    return err\n}","preventionTips":["Only extract archives downloaded from the pinned official URL with matching sha256","Pre-scan archives for '..' entries in CI before distribution","Treat traversal hits as security incidents, not recoverable errors"],"tags":["go","security","path-traversal","zip-slip","tar","extraction"],"backgroundTag":null,"analyzedSha":"973504e1770928ed5fb82f43da528f441ad9ddc3","analyzedAt":"2026-08-14T23:45:32.408Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}