Package io.agentscope.harness.agent.sandbox

Class WorkspaceArchiveExtractor

java.lang.Object

io.agentscope.harness.agent.sandbox.WorkspaceArchiveExtractor

public class WorkspaceArchiveExtractor
extends Object

Securely extracts tar archives into a target directory.

Applies strict path traversal guards before extracting each archive entry:

1. Rejects entries with absolute paths (starting with / or \)
2. Rejects entries containing .. path segments
3. Verifies the resolved destination path starts with the canonical root

These guards defend against the "Zip Slip" class of path traversal attacks.

Method Summary

Modifier and Type	Method	Description
static void	extractTarArchive(Path destRoot, InputStream tarStream)	Extracts a tar archive stream into the given destination directory.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

extractTarArchive

public static void extractTarArchive(Path destRoot,
 InputStream tarStream)
                              throws Exception

Extracts a tar archive stream into the given destination directory.

The destination directory must already exist. Existing files at the same paths will be replaced.

Parameters:

destRoot - the directory to extract into; must already exist

tarStream - the tar archive input stream; caller is responsible for closing

Throws:

SandboxException.SandboxRuntimeException - if a path traversal attempt is detected

Exception - if extraction fails for any other reason