GoArchiveTar

archive/tar package. Reader.Next() returns headers with user-controlled filenames — Zip Slip path traversal sink when extracting to filesystem.

1 source

Taint flow1 source → 0 sinks

Sources — untrusted input

.Next()Advances to next entry

Sources

— user-controlled input enters here

.Next()Source

Signature

Next() (*Header, error)

Advances to next entry. Header.Name is user-controlled — Zip Slip path traversal sink.

tracks:return

FQN	Field
archive/tar	fqns[0]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

go.mod

// standard library — no go.mod entry required

rule.py

from codepathfinder.go_rule import GoArchiveTar