security: tar extraction can escape through chained symlink sequence (Z-001) #920

Description

The tar extraction logic in internal/update/extract.go is vulnerable to a chained symbolic link escape. While the current implementation performs lexical checks to ensure paths remain within the destination directory (using ilepath.Join and similar string-based collapsing), it fails to account for the actual resolution on the filesystem.

Since the extraction process writes files using paths that follow real filesystem symlinks without employing O_NOFOLLOW, an attacker can craft a malicious archive containing a chain of symlinks that resolve progressively outside the target directory. For example:

• � $\rightarrow$ . (resolves to destination, passes check)
• � $\rightarrow$ �/.. (lexically collapses to destination, but on disk resolves to parent of destination)
• c $\rightarrow$ �/.. (resolves further out)

Impact

This vulnerability allows for arbitrary file writes as the user executing zero upgrade. Because this command is frequently run with elevated privileges for system-wide installations, this can be leveraged to achieve root or administrator level persistence on the host system.

Recommended Fixes

1. Strict Rejection: Reject any archive entry of type ar.TypeSymlink in release archives entirely, matching the security posture of the zip extraction path.
2. Rooted Descriptors: Implement extraction using an openat-relative descriptor chain rooted at the destination directory, ensuring O_NOFOLLOW is applied to every component of the path to prevent traversal via symlinks.
3. Identity Verification: Ensure the promotion stage continues to use the existing descriptor-bound rename and O_NOFOLLOW checks already present in internal/update/stage_other.go.