overlayWhiteoutConverter.ConvertRead: validate overlay whiteout targets

Validate overlay whiteout targets before creating the corresponding
character device.

Reject malformed entries whose target resolves to "." or "..". Archive
path traversal remains handled by Untar's normal path validation.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Author: thaJeztah

archive_linux.go

@@ -102,7 +102,9 @@ func (c overlayWhiteoutConverter) ConvertRead(hdr *tar.Header, filePath string)
 			// Regular file.
 			return true, nil
 		}
-
+		if !filepath.IsLocal(originalBase) {
+			return false, fmt.Errorf("invalid whiteout entry %q", filePath)
+		}
 		// If a file was deleted, and we are using overlay, we need to create a character device.
 		originalPath := filepath.Join(dir, originalBase)
 		if err := unix.Mknod(originalPath, unix.S_IFCHR, 0); err != nil {

archive_linux_test.go

@@ -181,6 +181,39 @@ func TestOverlayUntarWhiteoutLinkDir(t *testing.T) {
 	assert.Check(t, os.IsNotExist(err))
 }
 
+// TestOverlayUntarInvalidWhiteoutNames verifies that malformed whiteout names
+// are rejected. In particular, it rejects whiteout targets of "." and "..";
+// traversal in archive paths is handled by Untar's normal path validation.
+func TestOverlayUntarInvalidWhiteoutNames(t *testing.T) {
+	tests := []struct {
+		name string
+	}{
+		{name: WhiteoutPrefix},
+		{name: WhiteoutPrefix + "."},
+		{name: WhiteoutPrefix + ".."},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var archive bytes.Buffer
+			tw := tar.NewWriter(&archive)
+
+			err := tw.WriteHeader(&tar.Header{
+				Name:     tc.name,
+				Typeflag: tar.TypeReg,
+				Mode:     0o600,
+			})
+			assert.NilError(t, err)
+			assert.NilError(t, tw.Close())
+
+			err = Untar(bytes.NewReader(archive.Bytes()), t.TempDir(), &TarOptions{
+				WhiteoutFormat: OverlayWhiteoutFormat,
+			})
+			assert.ErrorContains(t, err, "invalid whiteout entry")
+		})
+	}
+}
+
 func TestOverlayTarAUFSUntar(t *testing.T) {
 	restore := overrideUmask(0)
 	defer restore()