node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

@@ -81,22 +81,46 @@ export class Header implements HeaderData {
       throw new Error('need 512 bytes for header')
     }
 
-    this.path = ex?.path ?? decString(buf, off, 100)
-    this.mode = ex?.mode ?? gex?.mode ?? decNumber(buf, off + 100, 8)
-    this.uid = ex?.uid ?? gex?.uid ?? decNumber(buf, off + 108, 8)
-    this.gid = ex?.gid ?? gex?.gid ?? decNumber(buf, off + 116, 8)
-    this.size = ex?.size ?? gex?.size ?? decNumber(buf, off + 124, 12)
-    this.mtime = ex?.mtime ?? gex?.mtime ?? decDate(buf, off + 136, 12)
+    // Decode the typeflag (independent of any pending PAX/GNU extended header)
+    // up front so we can tell whether THIS block is itself an intermediary
+    // extension header (PAX `x`/`g`, GNU long-name `L`, GNU long-link `K`).
+    // Per POSIX pax, a PAX extended header describes the *next file entry*, not
+    // the extension headers that may sit between it and that file. Applying the
+    // pending PAX overrides (notably `size`) to an intervening `L`/`K`/`x`/`g`
+    // header desynchronizes the stream relative to other tar implementations
+    // and enables tar interpretation-conflict / file-smuggling attacks.
+    const t = decString(buf, off + 156, 1)
+    const isNormalFS = types.normalFsTypes.has(t as EntryTypeCode)
+    const exForFields = isNormalFS ? ex : undefined
+    const gexForFields = isNormalFS ? gex : undefined
+
+    this.path = exForFields?.path ?? decString(buf, off, 100)
+    this.mode =
+      exForFields?.mode ??
+      gexForFields?.mode ??
+      decNumber(buf, off + 100, 8)
+    this.uid =
+      exForFields?.uid ?? gexForFields?.uid ?? decNumber(buf, off + 108, 8)
+    this.gid =
+      exForFields?.gid ?? gexForFields?.gid ?? decNumber(buf, off + 116, 8)
+    this.size =
+      exForFields?.size ??
+      gexForFields?.size ??
+      decNumber(buf, off + 124, 12)
+    this.mtime =
+      exForFields?.mtime ??
+      gexForFields?.mtime ??
+      decDate(buf, off + 136, 12)
     this.cksum = decNumber(buf, off + 148, 12)
 
     // if we have extended or global extended headers, apply them now
     // See https://github.com/npm/node-tar/pull/187
-    // Apply global before local, so it overrides
-    if (gex) this.#slurp(gex, true)
-    if (ex) this.#slurp(ex)
+    // Apply global before local, so it overrides. Never slurp the pending
+    // extended-header fields onto an intermediary extension header.
+    if (gexForFields) this.#slurp(gexForFields, true)
+    if (exForFields) this.#slurp(exForFields)
 
     // old tar versions marked dirs as a file with a trailing /
-    const t = decString(buf, off + 156, 1)
     if (types.isCode(t)) {
       this.#type = t || '0'
     }
@@ -118,12 +142,24 @@ export class Header implements HeaderData {
       buf.subarray(off + 257, off + 265).toString() === 'ustar\u000000'
     ) {
       /* c8 ignore start */
-      this.uname = ex?.uname ?? gex?.uname ?? decString(buf, off + 265, 32)
-      this.gname = ex?.gname ?? gex?.gname ?? decString(buf, off + 297, 32)
+      this.uname =
+        exForFields?.uname ??
+        gexForFields?.uname ??
+        decString(buf, off + 265, 32)
+      this.gname =
+        exForFields?.gname ??
+        gexForFields?.gname ??
+        decString(buf, off + 297, 32)
       this.devmaj =
-        ex?.devmaj ?? gex?.devmaj ?? decNumber(buf, off + 329, 8) ?? 0
+        exForFields?.devmaj ??
+        gexForFields?.devmaj ??
+        decNumber(buf, off + 329, 8) ??
+        0
       this.devmin =
-        ex?.devmin ?? gex?.devmin ?? decNumber(buf, off + 337, 8) ?? 0
+        exForFields?.devmin ??
+        gexForFields?.devmin ??
+        decNumber(buf, off + 337, 8) ??
+        0
       /* c8 ignore stop */
       if (buf[off + 475] !== 0) {
         // definitely a prefix, definitely >130 chars.

@@ -51,6 +51,27 @@ export type EntryTypeName =
   | 'OldExtendedHeader'
   | 'Unsupported'
 
+/**
+ * types that are a normal file system entry, not metadata.
+ *
+ * These can be the subject of extended/globalExtended headers, long path
+ * names, long linkpath names, etc.
+ *
+ * Any other types are meta, and cannot be targetted by extended PAX headers.
+ */
+export const normalFsTypes = new Set<EntryTypeCode>([
+  '0',
+  '',
+  '1',
+  '2',
+  '3',
+  '4',
+  '5',
+  '6',
+  '7',
+  'D',
+])
+
 // map types from key to human-friendly name
 export const name = new Map<EntryTypeCode, EntryTypeName>([
   ['0', 'File'],

@@ -1,5 +1,6 @@
 import t from 'tap'
 import { Header } from '../dist/esm/header.js'
+import { name } from '../dist/esm/types.js'
 
 t.test('ustar format', t => {
   const buf = Buffer.from(
@@ -677,3 +678,47 @@ t.test('tarmageddon, ensure that Header prioritizes Pax size', async t => {
   const hPax = new Header(h.block, 0, { size: 123 })
   t.equal(hPax.size, 123, 'if size is set in pax, takes priority')
 })
+
+t.test('do not apply ex/gex to meta entries', t => {
+  const normalEntryTypes = new Set([
+    'File',
+    'OldFile',
+    'Link',
+    'SymbolicLink',
+    'CharacterDevice',
+    'BlockDevice',
+    'Directory',
+    'FIFO',
+    'ContiguousFile',
+    'GNUDumpDir',
+  ])
+
+  for (const type of name.values()) {
+    const data = new Header({
+      path: 'x',
+      type,
+      size: 1,
+    })
+    data.encode()
+    const h = new Header(data.block, 0, {
+      size: 100,
+      dev: 5678,
+      ino: 9876,
+    })
+    if (normalEntryTypes.has(type)) {
+      if (h.type === 'Directory') {
+        t.equal(h.size, 0, 'Directories always size=0, no matter what')
+      } else {
+        t.equal(h.size, 100, `expect ${type} to respect extended header`)
+      }
+      t.equal(h.dev, 5678, `expect ${type} to respect extended header`)
+      t.equal(h.ino, 9876, `expect ${type} to respect extended header`)
+    } else {
+      t.equal(h.size, 1, `expect ${type} to ignore extended header`)
+      t.equal(h.dev, undefined, `expect ${type} to ignore extended header`)
+      t.equal(h.ino, undefined, `expect ${type} to ignore extended header`)
+    }
+  }
+
+  return t.end()
+})