Strip newlines from archive entry paths in diff headers (#8)

Archive entry names can contain literal newline characters, which when
interpolated into unified diff `---`/`+++` headers produce
attacker-controlled diff control lines. Strips `\n` and `\r` from
paths before emitting diff headers in `generateSimpleDiff` and
`generateAddedDiff`.

Author: andrew

diff/diff.go

@@ -208,10 +208,10 @@ func generateSimpleDiff(path string, oldContent, newContent []byte) (string, int
 	oldLines := strings.Split(string(oldContent), "\n")
 	newLines := strings.Split(string(newContent), "\n")
 
-	// Simple line-by-line comparison (can be improved with Myers algorithm)
 	var buf strings.Builder
-	fmt.Fprintf(&buf, "--- a/%s\n", path)
-	fmt.Fprintf(&buf, "+++ b/%s\n", path)
+	safePath := sanitizeDiffPath(path)
+	fmt.Fprintf(&buf, "--- a/%s\n", safePath)
+	fmt.Fprintf(&buf, "+++ b/%s\n", safePath)
 
 	linesAdded := 0
 	linesDeleted := 0
@@ -301,8 +301,9 @@ func generateSimpleDiff(path string, oldContent, newContent []byte) (string, int
 // generateAddedDiff generates a diff for a newly added file.
 func generateAddedDiff(path string, content []byte) string {
 	var buf strings.Builder
+	safePath := sanitizeDiffPath(path)
 	buf.WriteString("--- /dev/null\n")
-	fmt.Fprintf(&buf, "+++ b/%s\n", path)
+	fmt.Fprintf(&buf, "+++ b/%s\n", safePath)
 
 	lines := bytes.Split(content, []byte("\n"))
 	fmt.Fprintf(&buf, "@@ -0,0 +1,%d @@\n", len(lines))
@@ -314,6 +315,12 @@ func generateAddedDiff(path string, content []byte) string {
 	return buf.String()
 }
 
+var diffPathReplacer = strings.NewReplacer("\n", "", "\r", "")
+
+func sanitizeDiffPath(path string) string {
+	return diffPathReplacer.Replace(path)
+}
+
 // countLines counts the number of lines in content.
 func countLines(content []byte) int {
 	scanner := bufio.NewScanner(bytes.NewReader(content))

diff/diff_test.go

@@ -252,3 +252,58 @@ func TestCompareBinaryFiles(t *testing.T) {
 		t.Error("binary files should not have diff content")
 	}
 }
+
+func TestSanitizeDiffPath(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{"normal/path.go", "normal/path.go"},
+		{"has\nnewline", "hasnewline"},
+		{"has\r\ncrlf", "hascrlf"},
+		{"multi\n\n\nnewlines", "multinewlines"},
+		{"", ""},
+	}
+
+	for _, tt := range tests {
+		got := sanitizeDiffPath(tt.input)
+		if got != tt.want {
+			t.Errorf("sanitizeDiffPath(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}
+
+func TestDiffHeaderInjectionBlocked(t *testing.T) {
+	injectedPath := "evil.txt\n+++ b/etc/passwd\n@@ -0,0 +1 @@\n+root:x:0:0"
+	content := []byte("hello\n")
+
+	diff := generateAddedDiff(injectedPath, content)
+
+	headerCount := 0
+	for _, line := range strings.Split(diff, "\n") {
+		if strings.HasPrefix(line, "+++ ") {
+			headerCount++
+		}
+	}
+	if headerCount != 1 {
+		t.Errorf("expected 1 +++ header, got %d; newlines in path were not stripped", headerCount)
+	}
+}
+
+func TestUnifiedDiffHeaderInjectionBlocked(t *testing.T) {
+	injectedPath := "evil.txt\n--- a/etc/shadow"
+	oldContent := []byte("old\n")
+	newContent := []byte("new\n")
+
+	diff, _, _ := generateUnifiedDiff(injectedPath, oldContent, newContent)
+
+	minusCount := 0
+	for _, line := range strings.Split(diff, "\n") {
+		if strings.HasPrefix(line, "--- ") {
+			minusCount++
+		}
+	}
+	if minusCount != 1 {
+		t.Errorf("expected 1 --- header, got %d; newlines in path were not stripped", minusCount)
+	}
+}