python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-11-10 19:56:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

use os.path.commonpath instead of os.path.commonprefix

Browse Source 
Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>
This commit is contained in:
Ondrej Baranovič 2022-11-03 20:23:59 +01:00 committed by GitHub
parent 74c60b47a8
commit c10c6bf894
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
winbuild/build_prepare.py
View File

@ -474,7 +474,7 @@ def extract_dep(url, filename):
with zipfile.ZipFile(file) as zf: with zipfile.ZipFile(file) as zf:
for member in zf.namelist(): for member in zf.namelist():
member_abspath = os.path.abspath(os.path.join(sources_dir, member)) member_abspath = os.path.abspath(os.path.join(sources_dir, member))
member_prefix = os.path.commonprefix([sources_dir_abs, member_abspath]) member_prefix = os.path.commonpath([sources_dir_abs, member_abspath])
if sources_dir_abs != member_prefix: if sources_dir_abs != member_prefix:
raise RuntimeError("Attempted Path Traversal in Zip File") raise RuntimeError("Attempted Path Traversal in Zip File")
zf.extractall(sources_dir) zf.extractall(sources_dir)
@ -482,7 +482,7 @@ def extract_dep(url, filename):
with tarfile.open(file, "r:gz") as tgz: with tarfile.open(file, "r:gz") as tgz:
for member in tgz.getmembers(): for member in tgz.getmembers():
member_abspath = os.path.abspath(os.path.join(sources_dir, member.name)) member_abspath = os.path.abspath(os.path.join(sources_dir, member.name))
member_prefix = os.path.commonprefix([sources_dir_abs, member_abspath]) member_prefix = os.path.commonpath([sources_dir_abs, member_abspath])
if sources_dir_abs != member_prefix: if sources_dir_abs != member_prefix:
raise RuntimeError("Attempted Path Traversal in Tar File") raise RuntimeError("Attempted Path Traversal in Tar File")
tgz.extractall(sources_dir) tgz.extractall(sources_dir)