dongjoon-hyun opened a new pull request, #57283:
URL: https://github.com/apache/spark/pull/57283
### What changes were proposed in this pull request?
This PR fixes a zip-slip (arbitrary file write) vulnerability in
`RPackageUtils.extractRFolder`, which derived its output path from a JAR entry
name without any containment check. An entry named `R/pkg/../../../../.bashrc`
satisfies `indexOf("R/pkg") == 0`, so the `../` sequences survived into the
path and `new File(tempDir, entryPath)` resolved outside `tempDir`.
The output path is now computed once, above the directory/file branch, and
validated before either branch uses it:
```scala
val outPath = new File(tempDir, entryPath).getCanonicalFile
if (!outPath.getCanonicalPath.startsWith(tempDir.getCanonicalPath +
File.separator)) {
throw new IOException(s"Malicious zip entry escaping target dir:
${entry.getName}")
}
```
### Why are the changes needed?
`extractRFolder` runs from `SparkSubmit` (via `checkAndBuildRPackage`) for
any `--jars` / `--packages` JAR whose manifest carries the `Spark-HasRPackage`
flag. Submitting a malicious JAR could write arbitrary files outside `tempDir`
on the submitting host — overwriting `~/.bashrc`, for example, escalates to
code execution.
### Does this PR introduce _any_ user-facing change?
No. Well-formed R package JARs extract as before; only entries resolving
outside the extraction directory are now rejected.
### How was this patch tested?
Added `SPARK-58153: jar entries escaping the extraction directory are
rejected` to `RPackageUtilsSuite`, which builds a JAR with an
`R/pkg/../../../../evil.txt` entry and asserts `checkAndBuildRPackage` throws.
Confirmed it fails against the pre-fix code and passes with the fix.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 4.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
