BinlogDownloadQueue.saveFile() Arbitrary File Write via Malicious Tar Entry

[AAtomical]

• I have searched the issues of this repository and believe that this is not a duplicate.
• I have checked the FAQ of this repository and believe that this is not a duplicate.

environment

• canal version: latest master
• mysql version: N/A

Issue Description

BinlogDownloadQueue.saveFile() has a path traversal (Tar Slip) vulnerability. Tar entry names are passed directly to new File(parentFile, name + ".tmp") without any path validation (line 228–229):

String name = tarArchiveEntry.getName();
File tarFile = new File(parentFile, name + ".tmp");

A tar entry named ../../../tmp/pwned.txt writes outside the target directory. Canal downloads binlogs automatically and SSL verification is disabled in the same flow (NoopHostnameVerifier, trust-all SSLContext), so MITM is trivial.

Steps to reproduce

1. Craft a tar with a traversal entry: ../../../tmp/pwned.txt
2. Feed it to saveFile() extraction logic
3. File is written to /tmp/pwned.txt, outside the extraction directory

Expected behaviour

Reject entries that escape the target directory:

String canonicalDest = parentFile.getCanonicalPath();
String canonicalFile = tarFile.getCanonicalPath();
if (!canonicalFile.startsWith(canonicalDest + File.separator)) {
    throw new IOException("Tar entry outside target dir: " + name);
}

Actual behaviour

Arbitrary file write to any path on the filesystem. Verified with PoC — marker file written outside extraction directory with attacker-controlled content.