dbt-common: commonprefix() doesn't protect against path traversal

@@ -0,0 +1,7 @@
+kind: Security
+body: Replace os.path.commonprefix() with os.path.commonpath() to preventpath traversal
+  via sibling directories with matching prefixes.
+time: 2026-02-25T14:29:55.922683-05:00
+custom:
+  Author: emmyoop
+  PR: "1"

@@ -620,14 +620,20 @@ def rename(from_path: str, to_path: str, force: bool = False) -> None:
 def safe_extract(tarball: tarfile.TarFile, path: str = ".") -> None:
     """
     Fix for CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-    Solution copied from https://github.com/mindsdb/mindsdb/blob/main/mindsdb/utilities/fs.py
+
+    Uses os.path.commonpath() instead of commonprefix() to prevent path traversal
+    via sibling directories with matching prefixes (CVE-2026-1703).
     """
 
     def _is_within_directory(directory, target):
         abs_directory = os.path.abspath(directory)
         abs_target = os.path.abspath(target)
-        prefix = os.path.commonprefix([abs_directory, abs_target])
-        return prefix == abs_directory
+        try:
+            prefix = os.path.commonpath([abs_directory, abs_target])
+            return prefix == abs_directory
+        except ValueError:
+            # Captures the case of different drives on Windows so it fails safely
+            return False
 
     # for py >= 3.12
     if hasattr(tarfile, "data_filter"):

@@ -299,6 +299,25 @@ def test_untar_package_outside_directory(self) -> None:
         with self.assertRaises(tarfile.OutsideDestinationError):
             dbt_common.clients.system.untar_package(tar_file_full_path, self.tempdest)
 
+    def test_untar_package_sibling_path_traversal(self) -> None:
+        # A malicious tarball with a path that is a string prefix of the destination
+        # but not actually within it (e.g., "dest" vs "destevil")
+        with NamedTemporaryFile(
+            prefix="my-package.2", suffix=".tar.gz", dir=self.tempdir, delete=False
+        ) as named_tar_file:
+            tar_file_full_path = named_tar_file.name
+            with NamedTemporaryFile(prefix="a", suffix=".txt", dir=self.tempdir) as file_a:
+                file_a.write(b"malicious content")
+                # Create path that escapes to a sibling directory with matching prefix
+                # e.g., extracting to "/tmp/dest" but writing to "/tmp/destevil/file.txt"
+                sibling_path = "../" + os.path.basename(self.tempdest) + "evil/malicious.txt"
+                with tarfile.open(fileobj=named_tar_file, mode="w:gz") as tar:
+                    tar.addfile(tarfile.TarInfo(sibling_path), open(file_a.name))
+
+        assert tarfile.is_tarfile(tar.name)
+        with self.assertRaises(tarfile.OutsideDestinationError):
+            dbt_common.clients.system.untar_package(tar_file_full_path, self.tempdest)
+
 
 @pytest.mark.skipif(
     sys.version_info < (3, 12), reason="Tests Python 3.12+ tarfile filter='data' path"