Lino/StickExporterTX
1
0
Fork 0
mirror of https://github.com/LinoSchmidt/StickExporterTX.git synced 2026-03-20 17:44:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

Adding tarfile member sanitization to extractall()

Browse Source
This commit is contained in:
TrellixVulnTeam
2022-11-15 01:38:20 +00:00
parent fdfa9a1bb4
commit a013bced01
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
scripts/download-blender.py
View File

@@ -34,7 +34,26 @@ if(platform.system() == 'Linux'):
urllib.request.urlretrieve(linuxURL, './dependencies/linux/blender.tar.xz')
print("Extracting linux version")
with tarfile.open('./dependencies/linux/blender.tar.xz') as tfile:
tfile.extractall('./dependencies/linux')
def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tfile, "./dependencies/linux")
print("Adjust linux version")
oldLinuxName = linuxURL.split('/')[-1].replace('.tar.xz', '')