one more check to satisfy scanner

burov · burov · commit 02180cd61ac7 · 2025-09-01T16:59:22.000+02:00
diff --git a/policies/recipes/steps.go b/policies/recipes/steps.go
@@ -328,6 +328,10 @@ func extractTar(ctx context.Context, tarName string, dst string, archiveType age
 			return err
 		}
 
+		if err := ensureFilePathBelongsToDir(dst, filen); err != nil {
+			return err
+		}
+
 		filedir := filepath.Dir(filen)
 
 		if err := os.MkdirAll(filedir, 0700); err != nil {

Original file line number	Diff line number	Diff line change
`@@ -328,6 +328,10 @@ func extractTar(ctx context.Context, tarName string, dst string, archiveType age`
`328`	`328`	`return err`
`329`	`329`	`}`
`330`	`330`
	`331`	`+ if err := ensureFilePathBelongsToDir(dst, filen); err != nil {`
	`332`	`+ return err`
	`333`	`+ }`
	`334`	`+`
`331`	`335`	`filedir := filepath.Dir(filen)`
`332`	`336`
`333`	`337`	`if err := os.MkdirAll(filedir, 0700); err != nil {`