func (rarFormat) Read(input io.Reader, destination string) error {
	rr, err := rardecode.NewReader(input, "")
	if err != nil {
		return fmt.Errorf("read: failed to create reader: %v", err)
	}

	for {
		header, err := rr.Next()
		if err == io.EOF {
			break
		} else if err != nil {
			return err
		}

		err = sanitizeExtractPath(header.Name, destination)
		if err != nil {
			return err
		}

		destpath := filepath.Join(destination, header.Name)

		if header.IsDir {
			err = mkdir(destpath)
			if err != nil {
				return err
			}
			continue
		}

		// if files come before their containing folders, then we must
		// create their folders before writing the file
		err = mkdir(filepath.Dir(destpath))
		if err != nil {
			return err
		}

		err = writeNewFile(destpath, rr, header.Mode())
		if err != nil {
			return err
		}
	}

	return nil
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.