CVE-2007-4559 python: ensure sanity in our tarfiles

Python's tarfile module is not very careful about paths that step out
of the target directory. We can be a bit better at little cost.

This was reported in 2007[1], and has recently been publicised [2, for
example].

We were informed of this bug in December 2021 by Luis Alberto López
Alvar, but decided then that there were no circumstances under which
this was a security concern. That is, if you can alter the backup
files, you can already do worse things. But there is a case to guard
against an administrator being tricked into trying to restore a file
that isn't based on a real backup.

[1] https://nvd.nist.gov/vuln/detail/CVE-2007-4559
[2] https://www.theregister.com/2022/09/22/python_vulnerability_tarfile/

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15185

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Oct  4 03:48:43 UTC 2022 on sn-devel-184

python/samba/tests/safe_tarfile.py

@@ -0,0 +1,67 @@
+# Unix SMB/CIFS implementation.
+# Copyright (C) Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import tarfile
+from samba import safe_tarfile
+import tempfile
+
+import os
+from samba.tests import TestCaseInTempDir
+
+
+def filterer(prefix):
+    def f(info):
+        info.name = prefix + info.name
+        return info
+    return f
+
+
+class SafeTarFileTestCase(TestCaseInTempDir):
+
+    def test_dots(self):
+        filename = os.path.join(self.tempdir, 'x')
+        tarname = os.path.join(self.tempdir, 'tar.tar')
+        f = open(filename, 'w')
+        f.write('x')
+        f.close()
+
+        tf = tarfile.open(tarname, 'w')
+        tf.add(filename, filter=filterer('../../'))
+        tf.close()
+
+        stf = safe_tarfile.open(tarname)
+
+        self.assertRaises(tarfile.ExtractError,
+                          stf.extractall,
+                          tarname)
+        self.rm_files('x', 'tar.tar')
+
+    def test_slash(self):
+        filename = os.path.join(self.tempdir, 'x')
+        tarname = os.path.join(self.tempdir, 'tar.tar')
+        f = open(filename, 'w')
+        f.write('x')
+        f.close()
+
+        tf = tarfile.open(tarname, 'w')
+        tf.add(filename, filter=filterer('/'))
+        tf.close()
+
+        stf = safe_tarfile.open(tarname)
+        self.assertRaises(tarfile.ExtractError,
+                          stf.extractall,
+                          tarname)
+
+        self.rm_files('x', 'tar.tar')