Create tar-path-overwrite.yaml

file/nodejs/tar-path-overwrite.yaml

@@ -0,0 +1,22 @@
+id: tar-path-overwrite
+
+info:
+  name: Tar Path Overwrite
+  author: me_dheeraj (https://twitter.com/Dheerajmadhukar)
+  severity: info
+  description: Insecure TAR archive extraction can result in arbitrary path over write and can result in code injection.
+  tags: file,nodejs
+
+file:
+  - extensions:
+      - all
+
+    extractors:
+      - type: regex
+        regex:
+          - "\\$X = require\\('tar-stream'\\)"
+          - "\\$EXTRACT\\.on\\('entry', function \\$FUNC\\(...\\) {"
+          - "\\$FS\\.createWriteStream\\(\\$FIL, ...\\)"
+          - "\\$FS\\.writeFile\\(\\$FIL, ...\\)"
+          - "\\$FS\\.writeFileSync\\(\\$FIL, ...\\)"
+        condition: or