From 4efd48f74c61f4e6d5c655b8943fac54f975602b Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:10:16 +0000
Subject: [PATCH] Fix Directory Traversal in tar unpack

The `untar_archive` function incorrectly used `a.unpack()` which does not have built-in directory traversal protections. It has been updated to iterate over `a.entries()` and use `.unpack_in()` on each entry to prevent writing outside the destination directory.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/compress.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/stdlib/src/compress.rs b/stdlib/src/compress.rs
index d1daf83b..97582a98 100644
--- a/stdlib/src/compress.rs
+++ b/stdlib/src/compress.rs
@@ -258,7 +258,10 @@ pub fn untar_archive(archive_path: &str, dest_dir: &str) -> std::io::Result<()>
     // from escaping the destination directory. Therefore, we revert the manual
     // path validation that caused a regression with uncanonicalized relative paths.
 
-    a.unpack(dest_dir)?;
+    for entry in a.entries()? {
+        let mut entry = entry?;
+        entry.unpack_in(dest_dir)?;
+    }
     Ok(())
 }