fix sec

pkg/tools/archive/archive.go

@@ -44,7 +44,7 @@ func Untar(file io.Reader, path string) error {
 		}
 
 		// the target location where the dir/file should be created
-		target := filepath.Join(path, header.Name)
+		target := filepath.Clean(filepath.Join(path, filepath.Clean(header.Name)))
 
 		// the following switch could also be done using fi.Mode(), not sure if there
 		// a benefit of using one vs. the other.
@@ -122,7 +122,7 @@ func Tar(file io.Writer, root string) error {
 			return nil
 		}
 
-		file, err := os.Open(path)
+		file, err := os.Open(filepath.Clean(path))
 		if err != nil {
 			return fmt.Errorf("failed to open file: %w", err)
 		}

pkg/tools/hash/hash.go

@@ -5,16 +5,16 @@ import (
 	"encoding/hex"
 	"io"
 	"os"
+	"path/filepath"
 )
 
 func FileMD5(fp string) (string, error) {
-	f, err := os.OpenFile(fp, os.O_RDONLY, 0)
+	f, err := os.OpenFile(filepath.Clean(fp), os.O_RDONLY, 0)
 	if err != nil {
 		return "", err
 	}
 	defer f.Close()
 
-	
 	hasher := md5.New()
 	if _, err := io.Copy(hasher, f); err != nil {
 		return "", err