Prevent following symlinks during extracting normal files

This fixes #359, #361, #362.

integration/dockerfiles/Dockerfile_test_replaced_symlinks

@@ -0,0 +1,2 @@
+FROM tenstartups/alpine@sha256:31dc8b12e0f73a1de899146c3663644b7668f8fd198cfe9b266886c9abfa944b
+RUN pwd

pkg/util/fs_util.go

@@ -186,6 +186,13 @@ func extractFile(dest string, hdr *tar.Header, tr io.Reader) error {
 				return err
 			}
 		}
+		// Check if something already exists at path (symlinks etc.)
+		// If so, delete it
+		if FilepathExists(path) {
+			if err := os.Remove(path); err != nil {
+				return errors.Wrapf(err, "error removing %s to make way for new file.", path)
+			}
+		}
 		currFile, err := os.Create(path)
 		if err != nil {
 			return err