explosion/spaCy
1
1
Fork 0
mirror of https://github.com/explosion/spaCy.git synced 2025-08-09 22:54:53 +03:00
Code Issues Packages Projects Releases Wiki Activity

Simplify and add error message

Browse Source
This commit is contained in:
Adriane Boyd 2022-11-03 15:19:58 +01:00
parent 25d56ce0f7
commit 641f350144
2 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
spacy/cli/project/remote_storage.py
View File

@ -85,24 +85,17 @@ class RemoteStorage:
# This requires that the path is added correctly, relative # This requires that the path is added correctly, relative
# to root. This is how we set things up in push() # to root. This is how we set things up in push()
def is_within_directory(directory, target): def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory) abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target) abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target]) prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory return prefix == abs_directory
def safe_extract( def safe_extract(tar, path):
tar, path=".", members=None, *, numeric_owner=False
):
for member in tar.getmembers(): for member in tar.getmembers():
member_path = os.path.join(path, member.name) member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path): if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File") raise ValueError(Errors.E852)
tar.extractall(path)
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tar_file, self.root) safe_extract(tar_file, self.root)
return url return url

2
spacy/errors.py
View File

@ -542,6 +542,8 @@ class Errors(metaclass=ErrorsWithCodes):
E202 = ("Unsupported {name} mode '{mode}'. Supported modes: {modes}.") E202 = ("Unsupported {name} mode '{mode}'. Supported modes: {modes}.")
# New errors added in v3.x # New errors added in v3.x
E852 = ("The tar file pulled from the remote attempted an unsafe path "
"traversal.")
E853 = ("Unsupported component factory name '{name}'. The character '.' is " E853 = ("Unsupported component factory name '{name}'. The character '.' is "
"not permitted in factory names.") "not permitted in factory names.")
E854 = ("Unable to set doc.ents. Check that the 'ents_filter' does not " E854 = ("Unable to set doc.ents. Check that the 'ents_filter' does not "