[安全性] Devcontainer 功能的 tar 提取可以写入功能目录之外

set -euo pipefail workdir="$(mktemp -d)" trap 'rm -rf "$workdir"' EXIT git clone https://GitHub.com/harness/harness.git "$workdir/harness" cd "$workdir/harness" git checkout 34da7995c26b0c14df5c9848376c6263e611a75a cat > app/gitspace/orchestrator/utils/download_features_path_traversal_test.go <<'GO' package utils import ( "archive/tar" "os" "path/filepath" "strings" "testing" ) func TestUnpackTarballPathTraversal(t *testing.T) { base := t.TempDir() outDir := filepath.Join(base, "feature") if err := os.MkdirAll(outDir, 0755); err …