mirrors/element-web
1
0
Fork 0
mirror of https://github.com/element-hq/element-web synced 2024-11-24 10:15:43 +03:00
Code Issues Projects Releases Packages Wiki Activity

Adding tarfile member sanitization to extractall() (#23906)

Browse source 
Co-authored-by: Šimon Brandner <simon.bra.ag@gmail.com>
Co-authored-by: TrellixVulnTeam <charles.mcfarland@trellix.com>
This commit is contained in:
Michael Telatynski 2022-12-05 17:03:17 +00:00 committed by GitHub
parent 2cf4c5a26f
commit 7defcf3957
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
scripts/deploy.py
View file

@ -98,7 +98,24 @@ class Deployer:
try: try:
with tarfile.open(tarball) as tar: with tarfile.open(tarball) as tar:
tar.extractall(extract_path) def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tar, extract_path)
finally: finally:
if self.should_clean and downloaded: if self.should_clean and downloaded:
os.remove(tarball) os.remove(tarball)