fix: overwrite symlinks when extracting tarballs

content/file/file.go

@@ -394,7 +394,8 @@
 	return s.graph.Predecessors(ctx, node)
 }
 
-// Add adds a file into the file store.
+// Add adds a file or a directory into the file store.
+// Hard links within the directory are treated as regular files.
 func (s *Store) Add(ctx context.Context, name, mediaType, path string) (ocispec.Descriptor, error) {
 	if s.isClosedSet() {
 		return ocispec.Descriptor{}, ErrStoreClosed
@@ -615,16 +616,16 @@
 		}
 		rel, err := filepath.Rel(base, target)
 		if err != nil {
-			return "", ErrPathTraversalDisallowed
+			return "", fmt.Errorf("target path '%s' is outside of working dir '%s': %w", path, base, ErrPathTraversalDisallowed)
 		}
 		rel = filepath.ToSlash(rel)
 		if strings.HasPrefix(rel, "../") || rel == ".." {
-			return "", ErrPathTraversalDisallowed
+			return "", fmt.Errorf("target path '%s' is outside of working dir '%s' : %w", path, base, ErrPathTraversalDisallowed)
 		}
 	}
 	if s.DisableOverwrite {
 		if _, err := os.Stat(path); err == nil {
-			return "", ErrOverwriteDisallowed
+			return "", fmt.Errorf("file %s already exists: %w", path, ErrOverwriteDisallowed)
 		} else if !os.IsNotExist(err) {
 			return "", err
 		}