BuildStream is a powerful software integration tool that allows developers to automate the integration of software components including operating systems, and to streamline the software development and production process.
Apache BuildStream's tar source plugin extracts archives without safely resolving symbolic links (link following). A malicious source tarball can include a symlink entry that points outside the staging directory and then a file entry that writes through it, so a crafted upstream source can create or overwrite files on the host with the privileges of the user running BuildStream, as part of source fetching. On Python < 3.12 the plugin relied on an incomplete internal check (_assert_safe, which skipped symlink members and used a buggy basename/prefix comparison) as the only guard. The fix replaces that check with a custom extraction filter built on the Python tarfile data and tar filters, applied on all Python versions (using a local copy of tarfile.py on Python < 3.12).