fix: prevent tar option injection

agent/utils/files/tar.go

@@ -43,7 +43,7 @@ func (t TarArchiver) Compress(ctx context.Context, sourcePaths []string, dstFile
 		return err
 	}
 	baseDir := filepath.Dir(sourcePaths[0])
-	args := []string{t.getOptionStr("compress"), dstFile, "-C", baseDir}
+	args := []string{t.getOptionStr("compress"), dstFile, "-C", baseDir, "--"}
 	for _, sourcePath := range sourcePaths {
 		args = append(args, filepath.Base(sourcePath))
 	}

agent/utils/files/tar_gz.go

@@ -55,9 +55,9 @@ func (t TarGzArchiver) Compress(ctx context.Context, sourcePaths []string, dstFi
 		aheadDir = "/"
 	}
 	if len(secret) != 0 {
-		err = runTarGzEncryptToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, secret, append([]string{"-C", aheadDir}, itemDirs...)...)
+		err = runTarGzEncryptToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, secret, append([]string{"-C", aheadDir, "--"}, itemDirs...)...)
 	} else {
-		err = runTarGzToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, append([]string{"-C", aheadDir}, itemDirs...)...)
+		err = runTarGzToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, append([]string{"-C", aheadDir, "--"}, itemDirs...)...)
 	}
 	if err != nil {
 		return err