From 8c679c4c7ca54e321aecfcdb8e209895c6f3c681 Mon Sep 17 00:00:00 2001
From: TrellixVulnTeam <charles.mcfarland@trellix.com>
Date: Tue, 22 Nov 2022 04:17:54 +0000
Subject: [PATCH] Adding tarfile member sanitization to extractall()
---
util/bot/go/bootstrap.py | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/util/bot/go/bootstrap.py b/util/bot/go/bootstrap.py
index 61b9d4347..e86869a04 100755
--- a/util/bot/go/bootstrap.py
+++ b/util/bot/go/bootstrap.py
@@ -132,7 +132,26 @@ def install_toolset(toolset_root, url):
f.extractall(toolset_root)
elif pkg_path.endswith('.tar.gz'):
with tarfile.open(pkg_path, 'r:gz') as f:
- f.extractall(toolset_root)
+ def is_within_directory(directory, target):
+
+ abs_directory = os.path.abspath(directory)
+ abs_target = os.path.abspath(target)
+
+ prefix = os.path.commonprefix([abs_directory, abs_target])
+
+ return prefix == abs_directory
+
+ def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+ for member in tar.getmembers():
+ member_path = os.path.join(path, member.name)
+ if not is_within_directory(path, member_path):
+ raise Exception("Attempted Path Traversal in Tar File")
+
+ tar.extractall(path, members, numeric_owner=numeric_owner)
+
+
+ safe_extract(f, toolset_root)
else:
raise Failure('Unrecognized archive format')