Fix prefix validation edge-case when extracting

[egibs]

I noticed that several .tar.gz files have been failing to extract:

unable to process /tmp/malcontent-4121799038/srv/gitlab/vendor/project_templates/iosswift.tar.gz: extract to temp: failed to extract /tmp/malcontent-4121799038/srv/gitlab/vendor/project_templates/iosswift.tar.gz: invalid file path: ./

Turns out, we were checking the target path for a prefix with / appended, so the check would fail (and I was reporting the header name rather than the target file name).

This PR checks for just the clean directory name instead (and we're already handling relative path traversal checks elsewhere).

With these changes:

$ go run cmd/mal/mal.go --all analyze ~/Downloads/gitlab-rails/srv/gitlab/vendor/project_templates/iosswift.tar.gz
🔎 Scanning "~/Downloads/gitlab-rails/srv/gitlab/vendor/project_templates/iosswift.tar.gz"
├─ 🟡 ~/Downloads/gitlab-rails/srv/gitlab/vendor/project_templates/iosswift.tar.gz ∴ /project.bundle [MEDIUM]
│     ≡ credential [MEDIUM]
│       🟡 sniffer/bpf — BPF (Berkeley Packet Filter): bpf
│     ≡ networking [MEDIUM]
│       🟡 tcp/ssh — Supports SSH (secure shell)
│     ≡ process [LOW]
│       🔵 chdir — changes working directory: cd B
│
├─ 🔵 ~/Downloads/gitlab-rails/srv/gitlab/vendor/project_templates/iosswift.tar.gz ∴ /tree/project.json [LOW]
│     ≡ credential [LOW]
│       🔵 password — references a 'password': require_password_to_approve
│

[tstromberg]

This is subtle - nice catch! Can you add a test or testdata sample that verifies we continue to get this right?

[egibs]

This is subtle - nice catch! Can you add a test or testdata sample that verifies we continue to get this right?

Will do!

[egibs]

This is subtle - nice catch! Can you add a test or testdata sample that verifies we continue to get this right?

Added the samples that were running into this in chainguard-dev/malcontent-samples#48.

[egibs]

I'm going to have a follow-up PR to test the new logic (it definitely works but I don't want to hold up the release).

The new sample data only contain data files, so their refreshes and tests will need to selectively use that to prevent negatively affecting other tests (otherwise they'll run afoul of the new clean <= 2 severity check). It might just be easier to add some unit tests, but TBD.

Edit: unit tests were easier 🙂

[egibs]

Still works as expected:

$ go run cmd/mal/mal.go --all analyze out/chainguard-dev/malcontent-samples/linux/clean/gitlab-rails/iosswift.tar.gz 
🔎 Scanning "out/chainguard-dev/malcontent-samples/linux/clean/gitlab-rails/iosswift.tar.gz"
├─ 🟡 out/chainguard-dev/malcontent-samples/linux/clean/gitlab-rails/iosswift.tar.gz ∴ /project.bundle [MEDIUM]
│     ≡ credential [MEDIUM]
│       🟡 sniffer/bpf — BPF (Berkeley Packet Filter): bpf
│     ≡ networking [MEDIUM]
│       🟡 tcp/ssh — Supports SSH (secure shell)
│     ≡ process [LOW]
│       🔵 chdir — changes working directory: cd B
│
├─ 🔵 out/chainguard-dev/malcontent-samples/linux/clean/gitlab-rails/iosswift.tar.gz ∴ /tree/project.json [LOW]
│     ≡ credential [LOW]
│       🔵 password — references a 'password': require_password_to_approve
│