Expand description
Guarded extraction of a services tarball.
Hardened against path traversal: symlinks and every other non-regular
entry type, absolute paths, .. components, unlisted top-level
directories and destinations outside the target are rejected before
anything touches disk. The declared uncompressed size is accumulated as
entries are read so a decompression bomb is refused mid-stream rather than
after it has filled the volume.
TarLayout distinguishes the two archive shapes in use: a services
bundle carries bundle.json at the root with the tree under
BUNDLE_TREE_PREFIX, while a backup archive carries the tree at the
root.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.