[Bazel CI] ERROR: Bazel Build Failure: bazel_worker_api extraction failed due to invalid symlink violation (traversal)

[deepalak56]

CI: https://buildkite.com/bazel/bazel-at-head-plus-downstream/builds/5238#019bf879-d707-47cd-8983-cc3e78bd5656

Platform : Macos, Ubuntu, windows

ERROR: /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_tools/tools/build_defs/repo/http.bzl:200:45: An error occurred during the fetch of repository 'bazel_worker_api+':
--
Traceback (most recent call last):
File "/var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_tools/tools/build_defs/repo/http.bzl", line 200, column 45, in _http_archive_impl
download_info = ctx.download_and_extract(
Error in download_and_extract: java.io.IOException: Error extracting /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419/bazel-worker-api-v0.0.8.tar.gz to /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419: Tar entries cannot refer to files outside of their directory: /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419/bazel-worker-api-v0.0.8.tar.gz has a link bazel-worker-api-0.0.8/proto/.bazelversion pointing to ../.bazelversion
(04:09:20) WARNING: Download from https://android.googlesource.com/platform/dalvik/+archive/5a81c499a569731e2395f7c8d13c0e0d4e17a2b6.tar.gz failed: class java.net.SocketException Closed by interrupt
(04:09:20) ERROR: no such package '@@bazel_worker_api+//': java.io.IOException: Error extracting /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419/bazel-worker-api-v0.0.8.tar.gz to /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419: Tar entries cannot refer to files outside of their directory: /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419/bazel-worker-api-v0.0.8.tar.gz has a link bazel-worker-api-0.0.8/proto/.bazelversion pointing to ../.bazelversion
(04:09:20) ERROR: /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/rules_android+/src/tools/java/com/google/devtools/build/android/dexer/BUILD:39:13: @@rules_android+//src/tools/java/com/google/devtools/build/android/dexer:DexFileSplitter_lib depends on @@bazel_worker_api+//:worker_protocol_proto in repository @@bazel_worker_api+ which failed to fetch. no such package '@@bazel_worker_api+//': java.io.IOException: Error extracting /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419/bazel-worker-api-v0.0.8.tar.gz to /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419: Tar entries cannot refer to files outside of their directory: /var/lib/buildkite-agent/.cache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/bazel_worker_api+/temp3355029570245207419/bazel-worker-api-v0.0.8.tar.gz has a link bazel-worker-api-0.0.8/proto/.bazelversion pointing to ../.bazelversion
(04:09:20) ERROR: Analysis of target '//java/com/basicapp:basic_app_bundle' failed; build aborted: Analysis failed
(04:09:20) INFO: Elapsed time: 3.549s, Critical Path: 0.04s
(04:09:20) INFO: 1 process: 1 internal.
(04:09:20) ERROR: Build did NOT complete successfully
(04:09:20) FAILED:
Fetching repository @@rules_java++toolchains+remote_java_tools; starting
Fetching repository @@rules_android++remote_android_tools_extensions+android_tools; starting
Fetching repository @@rules_java++toolchains+remotejdk17_linux; starting
Fetching repository @@rules_java++toolchains+remote_java_tools_linux; starting
Fetching repository @@gazelle+; starting
Fetching https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.31.0.tar; 48.2 MiB (61.6%)
Fetching ...ache/bazel/_bazel_buildkite-agent/4dc3399a0366c5ad3db6b1ee22b84aeb/external/gazelle+; Extracting bazel-gazelle-v0.47.0.tar.gz
Fetching https://cdn.azul.com/zulu/bin/zulu17.62.17-ca-jdk17.0.17-linux_x64.tar.gz; 17.7 MiB (9.4%) ... (24 fetches)
bazel build failed with exit code 1

Culprit:

Steps:

git clone -v https://github.com/bazelbuild/rules_android.git /var/lib/buildkite-agent/builds/bk-docker-sl8w/bazel-org-repo-root/rules_android
git reset 880cd0e130e0f1e598c2ad7b0695070c0b34d946 --hard
export USE_BAZEL_VERSION=dd2494dd9ed4f4276ceeb4446168c8daf09a56d5
bazel build --enable_bzlmod --noenable_workspace --lockfile_mode=off //rules/...

CC Greenteam @fweikert

[deepalak56]

Looks like bazel_worker_api contains a file link that points "up" to a parent folder (dependency issue). And Bazel blocked the link because of security issue.

failure caused by this file: bazel-worker-api-v0.0.8.tar.gz

[ted-xie]

Look this this was already caught upstream in bazel-worker-api and addressed in version 0.0.9 of that module.

[ted-xie]

Ah, the commit to fix it hasn't been included in a new release yet.