chore(deps): [Security] Bump tar from 4.4.13 to 4.4.15#65

Bumps [tar](https://github.com/npm/node-tar) from 4.4.13 to 4.4.15. **This update includes security fixes.** <details> <summary>Vulnerabilities fixed</summary> <p><em>Sourced from <a href="https://github.com/advisories/GHSA-3jfq-g458-7qm9">The GitHub Security Advisory Database</a>.</em></p> <blockquote> <p><strong>Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization</strong></p> <h3>Impact</h3> <p>Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution</p> <p><code>node-tar</code> aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the <code>preservePaths</code> flag is not set to <code>true</code>. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example <code>/home/user/.bashrc</code> would turn into <code>home/user/.bashrc</code>.</p> <p>This logic was insufficient when file paths contained repeated path roots such as <code>////home/user/.bashrc</code>. <code>node-tar</code> would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. <code>///home/user/.bashrc</code>) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite.</p> <h3>Patches</h3> <p>3.2.2 || 4.4.14 || 5.0.6 || 6.1.1</p> <p>NOTE: an adjacent issue <a href="https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw">CVE-2021-32803</a> affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your <code>node-tar</code> use case.</p> <h3>Workarounds</h3> <p>Users may work around this vulnerability without upgrading by creating a custom <code>onentry</code> method which sanitizes the <code>entry.path</code> or a <code>filter</code> method which removes entries with absolute paths.</p> <pre lang="js"><code>const path = require('path') &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> <blockquote> <p>Affected versions: &gt;= 4.0.0 &lt; 4.4.14</p> </blockquote> <p><em>Sourced from <a href="https://github.com/advisories/GHSA-r628-mhmh-qjhw">The GitHub Security Advisory Database</a>.</em></p> <blockquote> <p><strong>Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning</strong></p> <h3>Impact</h3> <p>Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution</p> <p><code>node-tar</code> aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary <code>stat</code> calls to determine whether a given path is a directory, paths are cached when directories are created.</p> <p>This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the <code>node-tar</code> directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where <code>node-tar</code> checks for symlinks occur.</p> <p>By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass <code>node-tar</code> symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.</p> <p>This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.</p> <h3>Patches</h3> <p>3.2.3 || 4.4.15 || 5.0.7 || 6.1.2</p> <h3>Workarounds</h3> <p>Users may work around this vulnerability without upgrading by creating a custom <code>filter</code> method which prevents the extraction of symbolic links.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> <blockquote> <p>Affected versions: &gt;= 4.0.0 &lt; 4.4.15</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/node-tar/commit/843c897e6844f70a34bb115df6c8a9b60112aaf5"><code>843c897</code></a> 4.4.15</li> <li><a href="https://github.com/npm/node-tar/commit/46fe35083e2676e31c4e0a81639dce6da7aaa356"><code>46fe350</code></a> Remove paths from dirCache when no longer dirs</li> <li><a href="https://github.com/npm/node-tar/commit/df3aa4d10253a886be82519acb901b446ca3feeb"><code>df3aa4d</code></a> 4.4.14</li> <li><a href="https://github.com/npm/node-tar/commit/6d2801396fbad917ab8332ec8e91ff3d15bc22c6"><code>6d28013</code></a> add publishConfig tag</li> <li><a href="https://github.com/npm/node-tar/commit/efc6bb0dbd54df8c7285d7aac12bba959b8387a6"><code>efc6bb0</code></a> fix: strip absolute paths more comprehensively</li> <li>See full diff in <a href="https://github.com/npm/node-tar/compare/v4.4.13...v4.4.15">compare view</a></li> </ul> </details> <br /> [](https://dependabot.com/compatibility-score/?dependency-name=tar&package-manager=npm_and_yarn&previous-version=4.4.13&new-version=4.4.15) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details>