sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-12-16 00:23:52 +03:00
Code Activity

python:safe_tarfile: Improve safe extract()

Browse Source 
This also checks for symlinks and hardlinks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15390

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This commit is contained in:
Andreas Schneider
2023-06-06 15:38:12 +02:00
committed by Andrew Bartlett
parent 431f7698e4
commit 1f74f9f366
1 changed files with 1 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
python/samba/safe_tarfile.py
View File

@@ -35,17 +35,7 @@ class TarFile(UnsafeTarFile):
except AttributeError:
def extract(self, member, path="", set_attrs=True, *,
numeric_owner=False):
if isinstance(member, TarInfo):
name = member.name
else:
name = member
if '../' in name:
raise ExtractError(f"'../' is not allowed in path '{name}'")
if name.startswith('/'):
raise ExtractError(f"path '{name}' should not start with '/'")
self._safetarfile_check()
super().extract(member, path, set_attrs=set_attrs,
numeric_owner=numeric_owner)