From a0ccf4ca78384c6141cbbcda3c6ab72b12c88d11 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Wed, 26 Oct 2022 06:01:49 +0000 Subject: [PATCH] Adding tarfile member sanitization to extractall() --- .../deeplabcut/utils/auxfun_models.py | 42 ++++++++++++++++++- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/macos_v2.1.9_catalina/pyinstaller_packaging/move content to dist-DLC.app-MacOS/deeplabcut/utils/auxfun_models.py b/macos_v2.1.9_catalina/pyinstaller_packaging/move content to dist-DLC.app-MacOS/deeplabcut/utils/auxfun_models.py index 91adee2..78b8cad 100755 --- a/macos_v2.1.9_catalina/pyinstaller_packaging/move content to dist-DLC.app-MacOS/deeplabcut/utils/auxfun_models.py +++ b/macos_v2.1.9_catalina/pyinstaller_packaging/move content to dist-DLC.app-MacOS/deeplabcut/utils/auxfun_models.py @@ -71,7 +71,26 @@ def Downloadweights(modeltype, model_path): print("Downloading a ImageNet-pretrained model from {}....".format(url)) response = urllib.request.urlopen(url) with tarfile.open(fileobj=BytesIO(response.read()), mode="r:gz") as tar: - tar.extractall(path=target_dir) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, path=target_dir) except KeyError: print("Model does not exist: ", modeltype) print("Pick one of the following: ", neturls.keys()) @@ -122,7 +141,26 @@ def tarfilenamecutting(tarf): pbar = tqdm(unit="B", total=total_size, position=0) filename, _ = urllib.request.urlretrieve(url, reporthook=show_progress) with tarfile.open(filename, mode="r:gz") as tar: - tar.extractall(target_dir, members=tarfilenamecutting(tar)) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner=numeric_owner) + + + safe_extract(tar, target_dir, members=tarfilenamecutting(tar)) else: models = [ fn