Merge branch 'main' of github.com:n24q02m/qwen3-embed

Author: n24q02m

qwen3_embed/common/model_management.py

@@ -372,13 +372,20 @@ def decompress_to_cache(cls, targz_path: str, cache_dir: str) -> str:
                     # SECURITY: Validate symlink and hardlink targets to prevent
                     # arbitrary file writes outside the extraction directory.
                     if member.issym() or member.islnk():
-                        if os.path.isabs(member.linkname):
+                        if os.path.isabs(member.linkname) or member.linkname.startswith("/"):
                             raise tarfile.TarError(
                                 f"Attempted absolute path traversal in symlink/hardlink: {member.name} -> {member.linkname}"
                             )
-                        link_target_path = os.path.abspath(
-                            os.path.join(os.path.dirname(member_path), member.linkname)
-                        )
+                        if member.issym():
+                            # Symlinks resolve relative to the directory containing the link
+                            link_target_path = os.path.abspath(
+                                os.path.join(os.path.dirname(member_path), member.linkname)
+                            )
+                        else:
+                            # Hardlinks (LNKTYPE) resolve relative to the extraction root
+                            link_target_path = os.path.abspath(
+                                os.path.join(target_dir, member.linkname)
+                            )
                         if (
                             not link_target_path.startswith(target_dir + os.sep)
                             and link_target_path != target_dir

tests/test_model_management.py

@@ -459,6 +459,29 @@ def test_decompress_symlink_absolute_prevention(self, tmp_path):
 
         assert not cache_dir.exists()
 
+    def test_decompress_hardlink_traversal_prevention(self, tmp_path):
+        """Tar slip via hardlink resolved relative to extraction root is caught.
+
+        Hardlinks in tar archives resolve linkname relative to the archive root
+        (extraction directory), NOT relative to the containing directory like
+        symlinks. A nested hardlink with '../evil.txt' linkname must be detected
+        as escaping the target directory.
+        """
+        cache_dir = tmp_path / "tmp_cache_dir_hardlink_nested"
+        cache_dir.mkdir()
+
+        malicious_tar = tmp_path / "malicious_hardlink_nested.tar.gz"
+        with tarfile.open(malicious_tar, "w:gz") as tar:
+            info = tarfile.TarInfo(name="sub/nested/evil_hardlink")
+            info.type = tarfile.LNKTYPE
+            info.linkname = "../evil.txt"
+            tar.addfile(info)
+
+        with pytest.raises(tarfile.TarError):
+            ModelManagement.decompress_to_cache(str(malicious_tar), str(cache_dir))
+
+        assert not cache_dir.exists()
+
     def test_decompress_mid_extraction_failure(self, tmp_path):
         """Mid-extraction TarError is re-raised and cache dir is removed."""
         tar_path = make_tar_gz(tmp_path, inner_name="model.onnx")