From ceb1f262edc665e0152152ede282eaccd58c6074 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:10:29 +0000
Subject: [PATCH] Fix directory traversal vulnerability in tar unpack

Iterate over tar archive entries and call `unpack_in` on each entry instead
of using the top-level `Archive::unpack` method, ensuring proper directory
traversal protections are applied.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/compress.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/stdlib/src/compress.rs b/stdlib/src/compress.rs
index d1daf83b..97582a98 100644
--- a/stdlib/src/compress.rs
+++ b/stdlib/src/compress.rs
@@ -258,7 +258,10 @@ pub fn untar_archive(archive_path: &str, dest_dir: &str) -> std::io::Result<()>
     // from escaping the destination directory. Therefore, we revert the manual
     // path validation that caused a regression with uncanonicalized relative paths.
 
-    a.unpack(dest_dir)?;
+    for entry in a.entries()? {
+        let mut entry = entry?;
+        entry.unpack_in(dest_dir)?;
+    }
     Ok(())
 }