Thesis/ADNC
1
0
Fork 0
mirror of https://github.com/JoergFranke/ADNC.git synced 2024-11-17 13:58:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Adding tarfile member sanitization to extractall()

Browse Source
This commit is contained in:
TrellixVulnTeam 2022-10-29 20:06:10 +00:00
parent 4a5dfa5be1
commit d23940a68e
2 changed files with 43 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
adnc/data/tasks/babi.py
View File

@ -90,7 +90,29 @@ class bAbI():
with urlopen(req) as files:
with tarfile.open(fileobj=files, mode="r|gz") as tar:
tar.extractall(path=DEFAULT_DATA_FOLDER)
import os
def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tar, path=DEFAULT_DATA_FOLDER)
data_dir = data_dir / folder_name

21
adnc/data/tasks/cnn_rc.py
View File

@ -125,7 +125,26 @@ class ReadingComprehension():
print("### Extract CNN data")
with urlopen(req) as files:
with tarfile.open(fileobj=files, mode="r|gz") as tar:
tar.extractall(path=DEFAULT_DATA_FOLDER)
def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tar, path=DEFAULT_DATA_FOLDER)
print("### CNN data complete")
data_dir = data_dir / folder_name