From 74a8af9058e7d126a9f988ab5bf599d13ad054d9 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Sun, 20 Nov 2022 01:07:14 +0000 Subject: [PATCH] Adding tarfile member sanitization to extractall() --- .../twister2deepnet/deepnet/io/FileUtils.py | 42 ++++++++++++++++++- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/deeplearning/pytorch/src/main/python/twister2deepnet/deepnet/io/FileUtils.py b/deeplearning/pytorch/src/main/python/twister2deepnet/deepnet/io/FileUtils.py index 6939484483..98423aae51 100644 --- a/deeplearning/pytorch/src/main/python/twister2deepnet/deepnet/io/FileUtils.py +++ b/deeplearning/pytorch/src/main/python/twister2deepnet/deepnet/io/FileUtils.py @@ -88,10 +88,48 @@ def extract_archive(source_path, destination_path=None, clean=False): if FileUtils.is_tar(source_path): with tarfile.open(source_path, 'r') as tar: - tar.extractall(path=destination_path) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path=destination_path) elif FileUtils.is_targz(source_path): with tarfile.open(source_path, 'r:gz') as tar: - tar.extractall(path=destination_path) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path=destination_path) elif FileUtils.is_gzip(source_path): destination_path = os.path.join(destination_path, os.path.splitext(os.path.basename(source_path))[0])