# Delete directory using symlink when decompressing tar

Crafted gem with symlink entries caused `gem unpack` to recursively delete an arbitrary directory via `FileUtils.rm_rf` before symlink safety checks ran.

- Payout: $500
- Severity: medium
- Program: RubyGems
- Credited: ooooooo_q
- Disclosed: 2019-04-11
- CVE: CVE-2019-8320
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/317321
- Library page: https://bugbountylibrary.com/r/h1%3A317321
- Tags: domain:oss impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:chained technique:source-review vuln:path-traversal

**Target:** RubyGems `gem unpack` / Gem::Package tar extraction
**Root cause:** `FileUtils.rm_rf destination` runs before `mkdir_p_safe` validates the symlink path, so a symlink entry `tmp -> /tmp` followed by `tmp/dir` causes deletion of `/tmp/dir`.
**Steps:**
1. Build a gem whose data.tar.gz contains symlinks `tmp -> /tmp` and `tmp/dir -> .` (see builder.rb)
2. Create a victim dir `/tmp/dir` with files
3. Run `gem unpack rm_dir.gem`
4. Observe PathError raised but `/tmp/dir` already recursively deleted
**How found:** Code reading of the unpack flow: noticed `FileUtils.rm_rf destination` executes before `mkdir_p_safe` symlink validation, then crafted a tar with a symlink chain to prove the ordering bug.
**Exploitation:** Attacker ships a malicious gem; victim runs `gem unpack` or install, and the pre-validation `rm_rf` deletes an arbitrary directory reachable via the symlink chain. Only one symlink target per run due to the subsequent error.
**Insight:** When auditing archive extractors, check the ordering of cleanup/rm operations relative to path-safety validation — a symlink entry can redirect a later delete outside the extraction root before validation aborts.