move validate to separate func

pkg/util/tarcopy/tarcopy.go

@@ -50,11 +50,8 @@ func TarCopySrc(ctx context.Context, pathPrefix string) (outputChan chan wshrpc.
 			}
 
 			header.Name = filepath.Clean(strings.TrimPrefix(file, pathPrefix))
-			if header.Name == "" {
-				return nil
-			}
-			if strings.HasPrefix(header.Name, "/") {
-				header.Name = header.Name[1:]
+			if err := validatePath(header.Name); err != nil {
+				return err
 			}
 
 			// write header
@@ -68,6 +65,16 @@ func TarCopySrc(ctx context.Context, pathPrefix string) (outputChan chan wshrpc.
 		}
 }
 
+func validatePath(path string) error {
+	if strings.Contains(path, "..") {
+		return fmt.Errorf("invalid path containing directory traversal: %s", path)
+	}
+	if strings.HasPrefix(path, "/") {
+		return fmt.Errorf("invalid path starting with /: %s", path)
+	}
+	return nil
+}
+
 // TarCopyDest reads a tar stream from a channel and writes the files to the destination.
 // readNext is a function that is called for each file in the tar stream to read the file data. It should return an error if the file cannot be read.
 // The function returns an error if the tar stream cannot be read.