port fix from main

Author: mafintosh

index.js

@@ -254,6 +254,8 @@ exports.extract = function (cwd, opts) {
     var onsymlink = function () {
       if (win32) return next() // skip symlinks on win for now before it can be tested
       xfs.unlink(name, function () {
+        var dst = path.resolve(path.dirname(name), header.linkname)
+        if (!dst.startsWith(path.resolve(cwd))) return next(new Error(name + ' is not a valid symlink'))
         xfs.symlink(header.linkname, name, stat)
       })
     }

test/index.js

@@ -304,7 +304,7 @@ test('do not extract invalid tar', function (t) {
   fs.createReadStream(a)
     .pipe(tar.extract(out))
     .on('error', function (err) {
-      t.ok(/is not a valid path/i.test(err.message))
+      t.ok(/is not a valid symlink/i.test(err.message))
       fs.stat(path.join(out, '../bar'), function (err) {
         t.ok(err)
         t.end()