GeezerVison

Problem

When a volume workspace copied extra repository files, it added repository-controlled paths directly to Docker mount arguments and a shell command. A crafted directory name could change the mount configuration and run commands inside the trusted workspace helper. Those commands could read files from the machine running src.

This fixes VULN-140.

Solution

Package the extra files in a temporary tar archive. Validate that every archive path is relative and clean, mount the archive at a fixed location, and extract it with fixed tar arguments. Repository paths are now treated only as data and are not interpreted by Docker or a shell.

Verification Evidence

• go test ./internal/batches/...
• Added a regression test with a repository path containing shell and Docker mount syntax.
• Ran the volume workspace helper in Docker and confirmed that it extracted the crafted path as a normal file without running it as a command.