Rip&Tear 32d2da1bfb Fix symlink path traversal in skill archive extraction ...

`_safe_extractall` (the Python < 3.12 fallback used by `crewai skills`
archive unpacking) validated each member's *name* against the destination
but never validated symlink/hardlink *targets*. A malicious skill tarball
could plant a symlink escaping the destination (e.g. `link -> /home/user/.ssh`)
followed by a regular member written through it (`link/authorized_keys`),
escaping `dest` even though every member name resolves inside it — the
classic symlink-extraction traversal.

The 3.12+ path (`extractall(..., filter="data")`) already blocks this; the
fallback now mirrors it by rejecting absolute link targets and any link
target that resolves outside the destination directory.

Adds regression tests covering absolute and relative escaping symlinks plus
benign in-tree symlinks and ordinary archives.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-19 12:57:17 +08:00

..

__init__.py

feat: Skills Repository — registry, cache, CLI, and SDK integration (#5867)

2026-05-20 14:38:25 -03:00

test_safe_extract.py

Fix symlink path traversal in skill archive extraction

2026-06-19 12:57:17 +08:00