[snip]+  private static final Pattern validFilePathChars = Pattern.compile("(^[a-zA-Z][a-zA-Z0-9_.\-\s()]*)\.([tT][aA][rR]\.[gG][zZ])$");[snip]   private void validateGzipBundle(final IAppBundleInstallTaskState taskState) {     if (Utilities.isNullOrEmpty(taskState.filePath)) {       File agcUseCasePackDir = new File("/var/apm/f5-iappslx-agc-usecase-pack/");       if (!agcUseCasePackDir.exists() || !agcUseCasePackDir.isDirectory()) {         String error = "Access Guided Configuration use case pack not found on BIG-IP. Please upload and install the pack.";         failTask(taskState, error, "");         return;       }       File[] agcUseCasePack = agcUseCasePackDir.listFiles();       if (agcUseCasePack == null || agcUseCasePack.length == 0 || !agcUseCasePack[0].isFile()) {
         String error = "Access Guided Configuration use case pack not found on BIG-IP. Please upload and install the pack.";         failTask(taskState, error, "");         return;       }       taskState.filePath = agcUseCasePack[0].getPath();     }
+    String filename = taskState.filePath.substring(taskState.filePath.lastIndexOf('/') + 1);+    Matcher m = validFilePathChars.matcher(filename);+    if (!m.matches()) {+      String errorMessage = String.format("Access Guided Configuration use case pack validation failed: the file name %s must begin with alphabet, and only contain letters, numbers, spaces and/or special characters (underscore (_), period (.), hyphen (-) and round brackets ()). Only a .tar.gz file is allowed", new Object[] { filename });++++      failTask(taskState, errorMessage, "");++      return;+    }     final String extractTarCommand = "tar -xf " + taskState.filePath + " -O > /dev/null";

     ShellExecutor extractTar = new ShellExecutor(extractTarCommand);
     CompletionHandler<ShellExecutionResult> executionFinishedHandler = new CompletionHandler<ShellExecutionResult>()       {         public void completed(ShellExecutionResult extractQueryResult)         {           if (extractQueryResult.getExitStatus().intValue() != 0) {             String error = extractTarCommand + " failed with exit code=" + extractQueryResult.getExitStatus();

             IAppBundleInstallTaskCollectionWorker.this.failTask(taskState, "Usecase pack validation failed. Please ensure that usecase pack is a valid tar archive.", error + "stdout + stderr=" + extractQueryResult.getOutput());

             return;           }

           taskState.step = IAppBundleInstallTaskState.IAppBundleInstallStep.QUERY_INSTALLED_RPM;           IAppBundleInstallTaskCollectionWorker.this.sendStatusUpdate(taskState);         }

         public void failed(Exception ex, ShellExecutionResult rpmQueryResult) {           IAppBundleInstallTaskCollectionWorker.this.failTask(taskState, "Usecase pack validation failed. Please ensure that usecase pack is a valid tar archive.", String.format("%s failed", new Object[] { this.val$extractTarCommand }) + RestHelper.throwableStackToString(ex));         }       };


     extractTar.startExecution(executionFinishedHandler);   }[snip]

wvu@kharak:~$ curl -ksu admin:[redacted] https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '{"filePath":"`id`"}' | jq .{  "filePath": "`id`",  "toBeInstalledAppRpmsIndex": -1,  "id": "36671f83-d1be-4f5a-a2e6-7f9442a2a76f",  "status": "CREATED",  "userReference": {    "link": "https://localhost/mgmt/shared/authz/users/admin"  },  "identityReferences": [    {      "link": "https://localhost/mgmt/shared/authz/users/admin"    }  ],  "ownerMachineId": "ac2562f0-e41f-4652-ba35-6a2b804b235e",  "generation": 1,  "lastUpdateMicros": 1615930477819656,  "kind": "tm:access:bundle-install-tasks:iappbundleinstalltaskstate",  "selfLink": "https://localhost/mgmt/tm/access/bundle-install-tasks/36671f83-d1be-4f5a-a2e6-7f9442a2a76f"}wvu@kharak:~$

[pid 64748] execve("/bin/tar", ["tar", "-xf", "uid=0(root)", "gid=0(root)", "groups=0(root)", "context=system_u:system_r:initrc_t:s0", "-O"], [/* 9 vars */]) = 0

[SEVERE][10029][16 Mar 2021 21:34:37 UTC][8100/tm/access/bundle-install-tasks IAppBundleInstallTaskCollectionWorker] Usecase pack validation failed. Please ensure that usecase pack is a valid tar archive. error details: tar -xf `id` -O > /dev/null failedorg.apache.commons.exec.ExecuteException: Process exited with an error: 2 (Exit value: 2)  at org.apache.commons.exec.DefaultExecutor.executeInternal(DefaultExecutor.java:404)  at org.apache.commons.exec.DefaultExecutor.access$200(DefaultExecutor.java:48)  at org.apache.commons.exec.DefaultExecutor$1.run(DefaultExecutor.java:200)  at java.lang.Thread.run(Thread.java:748)