python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-07-12 17:22:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6704 from nulano/cve-2007-4559

Browse Source 
CVE-2007-4559 patch in winbuild
This commit is contained in:
Andrew Murray 2022-11-08 13:01:54 +11:00 committed by GitHub
commit 13dee16f99
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
winbuild/build_prepare.py
View File

@ -470,11 +470,22 @@ def extract_dep(url, filename):
raise RuntimeError(ex) raise RuntimeError(ex)
print("Extracting " + filename) print("Extracting " + filename)
sources_dir_abs = os.path.abspath(sources_dir)
if filename.endswith(".zip"): if filename.endswith(".zip"):
with zipfile.ZipFile(file) as zf: with zipfile.ZipFile(file) as zf:
for member in zf.namelist():
member_abspath = os.path.abspath(os.path.join(sources_dir, member))
member_prefix = os.path.commonpath([sources_dir_abs, member_abspath])
if sources_dir_abs != member_prefix:
raise RuntimeError("Attempted Path Traversal in Zip File")
zf.extractall(sources_dir) zf.extractall(sources_dir)
elif filename.endswith(".tar.gz") or filename.endswith(".tgz"): elif filename.endswith(".tar.gz") or filename.endswith(".tgz"):
with tarfile.open(file, "r:gz") as tgz: with tarfile.open(file, "r:gz") as tgz:
for member in tgz.getnames():
member_abspath = os.path.abspath(os.path.join(sources_dir, member))
member_prefix = os.path.commonpath([sources_dir_abs, member_abspath])
if sources_dir_abs != member_prefix:
raise RuntimeError("Attempted Path Traversal in Tar File")
tgz.extractall(sources_dir) tgz.extractall(sources_dir)
else: else:
raise RuntimeError("Unknown archive type: " + filename) raise RuntimeError("Unknown archive type: " + filename)