Make extraction safer

lib/mixlib/archive.rb

@@ -13,10 +13,10 @@ def initialize(archive, empty: false)
       @extractor = Mixlib::Archive::Tar.new(archive)
     end
 
-    def extract(destination)
+    def extract(destination, perms: true, ignore: [])
       create_and_empty(destination)
 
-      extractor.extract(destination)
+      extractor.extract(destination, perms: perms, ignore: ignore)
     end
 
     private

lib/mixlib/archive/tar.rb

@@ -14,28 +14,41 @@ def initialize(archive, options = {})
         @options = options
       end
 
-      def extract(destination)
+      # Extracts the archive to the given +destination+
+      #
+      # === Parameters
+      # perms<Boolean>:: should the extracter use permissions from the archive.
+      # ignore[Array]:: an array of matches of file paths to ignore
+      def extract(destination, perms: true, ignore: [])
         # (http://stackoverflow.com/a/31310593/506908)
+        ignore_re = Regexp.union(ignore)
         reader do |tar|
           dest = nil
           tar.each do |entry|
             if entry.full_name == TAR_LONGLINK
               dest = File.join(destination, entry.read.strip)
               next
             end
+            next if entry.full_name =~ ignore_re
             dest ||= File.join(destination, entry.full_name)
             parent = File.dirname(dest)
-            FileUtils.mkdir_p(parent, mode: 0755)
+            FileUtils.mkdir_p(parent)
 
             if entry.directory? || (entry.header.typeflag == "" && entry.full_name.end_with?("/"))
               File.delete(dest) if File.file?(dest)
-              FileUtils.mkdir_p(dest, mode: entry.header.mode, verbose: false)
+
+              if perms
+                FileUtils.mkdir_p(dest, mode: entry.header.mode, verbose: false)
+              else
+                FileUtils.mkdir_p(dest, verbose: false)
+              end
+
             elsif entry.file? || (entry.header.typeflag == "" && !entry.full_name.end_with?("/"))
               FileUtils.rm_rf(dest) if File.directory?(dest)
               File.open(dest, "wb") do |f|
                 f.print(entry.read)
               end
-              FileUtils.chmod(entry.header.mode, dest, verbose: false)
+              FileUtils.chmod(entry.header.mode, dest, verbose: false) if perms
             elsif entry.header.typeflag == "2"
               # handle symlink
               File.symlink(entry.header.linkname, dest)

lib/mixlib/archive/version.rb

@@ -1,5 +1,5 @@
 module Mixlib
   class Archive
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

spec/mixlib/archive_spec.rb

@@ -44,9 +44,14 @@
     end
 
     it "runs the extractor" do
-      expect(extractor).to receive(:extract).with(destination)
+      expect(extractor).to receive(:extract).with(destination, { perms: true, ignore: [] })
       archive.extract(destination)
     end
+
+    it "passes options to the extractor" do
+      expect(extractor).to receive(:extract).with(destination, { perms: false, ignore: [] })
+      archive.extract(destination, perms: false)
+    end
   end
 
   describe "#create_and_empty" do