CVE-2007-4559 Patch

frontend/mate/mate/build/build.py

@@ -670,7 +670,26 @@ def _attach_source_lines_to_nodes(self, session: orm.Session) -> None:
                 # TODO(ww): Maybe support other kinds of tarballs/archives? Worth it?
                 local_artifact = source_artifact.persist_locally(suffix=".tar.gz")
                 with tarfile.open(local_artifact, "r:gz") as tar:
-                    tar.extractall(path=temp_source_dir.name)
+                    def is_within_directory(directory, target):
+
+                        abs_directory = os.path.abspath(directory)
+                        abs_target = os.path.abspath(target)
+
+                        prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                        return prefix == abs_directory
+
+                    def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                        for member in tar.getmembers():
+                            member_path = os.path.join(path, member.name)
+                            if not is_within_directory(path, member_path):
+                                raise Exception("Attempted Path Traversal in Tar File")
+
+                        tar.extractall(path, members, numeric_owner) 
+
+
+                    safe_extract(tar, path=temp_source_dir.name)
                 source_dir = Path(temp_source_dir.name)
             elif source_artifact.kind == ArtifactKind.CompileTargetBrokeredChallenge:
                 local_artifact = source_artifact.persist_locally(suffix=".zip")

frontend/mate/mate/build/compile.py

@@ -710,7 +710,26 @@ def _compile_tarball_local(self, artifact: db.Artifact) -> None:
         try:
             # TODO(ww): Maybe support other kinds of tarballs/archives? Worth it?
             with tarfile.open(local_target, "r:gz") as tar:
-                tar.extractall(path=local_target_dir.name)
+                def is_within_directory(directory, target):
+
+                    abs_directory = os.path.abspath(directory)
+                    abs_target = os.path.abspath(target)
+
+                    prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                    return prefix == abs_directory
+
+                def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                    for member in tar.getmembers():
+                        member_path = os.path.join(path, member.name)
+                        if not is_within_directory(path, member_path):
+                            raise Exception("Attempted Path Traversal in Tar File")
+
+                    tar.extractall(path, members, numeric_owner) 
+
+
+                safe_extract(tar, path=local_target_dir.name)
         except tarfile.TarError as e:
             self._raise(
                 f"failed to open/extract tarball: {e}",
@@ -785,7 +804,26 @@ def _compile_tarball_containerized(self, artifact: db.Artifact) -> None:
         local_target = artifact.persist_locally(suffix=".tar.gz")
         try:
             with tarfile.open(local_target, "r:gz") as tar:
-                tar.extractall(path=scratch_src)
+                def is_within_directory(directory, target):
+
+                    abs_directory = os.path.abspath(directory)
+                    abs_target = os.path.abspath(target)
+
+                    prefix = os.path.commonprefix([abs_directory, abs_target])
+
+                    return prefix == abs_directory
+
+                def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+                    for member in tar.getmembers():
+                        member_path = os.path.join(path, member.name)
+                        if not is_within_directory(path, member_path):
+                            raise Exception("Attempted Path Traversal in Tar File")
+
+                    tar.extractall(path, members, numeric_owner) 
+
+
+                safe_extract(tar, path=scratch_src)
         except tarfile.TarError as e:
             self._raise(
                 "failed to open/extract tarball",