From 25d56ce0f74f2eaf2fd31c10d7c4fe6d71847d4b Mon Sep 17 00:00:00 2001 From: Adriane Boyd Date: Thu, 3 Nov 2022 12:43:50 +0100 Subject: [PATCH] Format --- spacy/cli/project/remote_storage.py | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/spacy/cli/project/remote_storage.py b/spacy/cli/project/remote_storage.py index 5f4b0379f..e65532de2 100644 --- a/spacy/cli/project/remote_storage.py +++ b/spacy/cli/project/remote_storage.py @@ -85,24 +85,25 @@ class RemoteStorage: # This requires that the path is added correctly, relative # to root. This is how we set things up in push() def is_within_directory(directory, target): - + abs_directory = os.path.abspath(directory) abs_target = os.path.abspath(target) - + prefix = os.path.commonprefix([abs_directory, abs_target]) - + return prefix == abs_directory - - def safe_extract(tar, path=".", members=None, *, numeric_owner=False): - + + def safe_extract( + tar, path=".", members=None, *, numeric_owner=False + ): + for member in tar.getmembers(): member_path = os.path.join(path, member.name) if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - - tar.extractall(path, members, numeric_owner=numeric_owner) - - + + tar.extractall(path, members, numeric_owner=numeric_owner) + safe_extract(tar_file, self.root) return url