python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-02-28 18:10:33 +03:00
Code Issues Packages Projects Releases Wiki Activity

simplify patch, also check zipfile

Browse Source
This commit is contained in:
nulano 2022-10-30 23:45:49 +00:00
parent e50a3a213e
commit 74c60b47a8
No known key found for this signature in database
GPG Key ID: B650CDF63B705766
1 changed files with 12 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
winbuild/build_prepare.py
View File

@ -469,31 +469,23 @@ def extract_dep(url, filename):
raise RuntimeError(ex) raise RuntimeError(ex)
print("Extracting " + filename) print("Extracting " + filename)
sources_dir_abs = os.path.abspath(sources_dir)
if filename.endswith(".zip"): if filename.endswith(".zip"):
with zipfile.ZipFile(file) as zf: with zipfile.ZipFile(file) as zf:
for member in zf.namelist():
member_abspath = os.path.abspath(os.path.join(sources_dir, member))
member_prefix = os.path.commonprefix([sources_dir_abs, member_abspath])
if sources_dir_abs != member_prefix:
raise RuntimeError("Attempted Path Traversal in Zip File")
zf.extractall(sources_dir) zf.extractall(sources_dir)
elif filename.endswith(".tar.gz") or filename.endswith(".tgz"): elif filename.endswith(".tar.gz") or filename.endswith(".tgz"):
with tarfile.open(file, "r:gz") as tgz: with tarfile.open(file, "r:gz") as tgz:
def is_within_directory(directory, target): for member in tgz.getmembers():
member_abspath = os.path.abspath(os.path.join(sources_dir, member.name))
abs_directory = os.path.abspath(directory) member_prefix = os.path.commonprefix([sources_dir_abs, member_abspath])
abs_target = os.path.abspath(target) if sources_dir_abs != member_prefix:
raise RuntimeError("Attempted Path Traversal in Tar File")
prefix = os.path.commonprefix([abs_directory, abs_target]) tgz.extractall(sources_dir)
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tgz, sources_dir)
else: else:
raise RuntimeError("Unknown archive type: " + filename) raise RuntimeError("Unknown archive type: " + filename)