From 30b82835cfb1f7035ad81af59085a25f8403a3ed Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Fri, 30 Sep 2022 02:10:38 +0000 Subject: [PATCH 1/2] Adding tarfile member sanitization to extractall() --- ilmbase/2.2.0/rezbuild.py | 21 ++++++++++++++++++++- openexr/2.2.0/rezbuild.py | 21 ++++++++++++++++++++- zlib/1.2.11/rezbuild.py | 21 ++++++++++++++++++++- 3 files changed, 60 insertions(+), 3 deletions(-) diff --git a/ilmbase/2.2.0/rezbuild.py b/ilmbase/2.2.0/rezbuild.py index 6938e06..accbeb8 100644 --- a/ilmbase/2.2.0/rezbuild.py +++ b/ilmbase/2.2.0/rezbuild.py @@ -22,7 +22,26 @@ def build(source_path, build_path, install_path, targets): # Unzip the source print("Unzipping to: %s" % build_path) with tarfile.TarFile.open(archive, mode='r:gz') as tar: - tar.extractall(build_path) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(tar, build_path) folder_name = filename.rsplit(".tar.gz")[0] source_root = os.path.join(build_path, folder_name) diff --git a/openexr/2.2.0/rezbuild.py b/openexr/2.2.0/rezbuild.py index 9c45157..093fcb0 100644 --- a/openexr/2.2.0/rezbuild.py +++ b/openexr/2.2.0/rezbuild.py @@ -23,7 +23,26 @@ def build(source_path, build_path, install_path, targets): # Unzip the source print("Unzipping to: %s" % build_path) with tarfile.TarFile.open(archive, mode='r:gz') as tar: - tar.extractall(build_path) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(tar, build_path) folder_name = filename.rsplit(".tar.gz")[0] source_root = os.path.join(build_path, folder_name) diff --git a/zlib/1.2.11/rezbuild.py b/zlib/1.2.11/rezbuild.py index ec912e9..a10d618 100644 --- a/zlib/1.2.11/rezbuild.py +++ b/zlib/1.2.11/rezbuild.py @@ -22,7 +22,26 @@ def build(source_path, build_path, install_path, targets): # Unzip the source print("Unzipping to: %s" % build_path) with tarfile.TarFile.open(archive, mode='r:gz') as tar: - tar.extractall(build_path) + def is_within_directory(directory, target): + + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + + prefix = os.path.commonprefix([abs_directory, abs_target]) + + return prefix == abs_directory + + def safe_extract(tar, path=".", members=None, *, numeric_owner=False): + + for member in tar.getmembers(): + member_path = os.path.join(path, member.name) + if not is_within_directory(path, member_path): + raise Exception("Attempted Path Traversal in Tar File") + + tar.extractall(path, members, numeric_owner) + + + safe_extract(tar, build_path) folder_name = filename.rsplit(".tar.gz")[0] source_root = os.path.join(build_path, folder_name) From 367f233531000cdd4094c658e68967141999bb15 Mon Sep 17 00:00:00 2001 From: TrellixVulnTeam Date: Mon, 3 Oct 2022 20:16:40 +0000 Subject: [PATCH 2/2] Adding numeric_owner as keyword arguement --- ilmbase/2.2.0/rezbuild.py | 2 +- openexr/2.2.0/rezbuild.py | 2 +- zlib/1.2.11/rezbuild.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/ilmbase/2.2.0/rezbuild.py b/ilmbase/2.2.0/rezbuild.py index accbeb8..4393c14 100644 --- a/ilmbase/2.2.0/rezbuild.py +++ b/ilmbase/2.2.0/rezbuild.py @@ -38,7 +38,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(tar, build_path) diff --git a/openexr/2.2.0/rezbuild.py b/openexr/2.2.0/rezbuild.py index 093fcb0..c58f444 100644 --- a/openexr/2.2.0/rezbuild.py +++ b/openexr/2.2.0/rezbuild.py @@ -39,7 +39,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(tar, build_path) diff --git a/zlib/1.2.11/rezbuild.py b/zlib/1.2.11/rezbuild.py index a10d618..7f45d61 100644 --- a/zlib/1.2.11/rezbuild.py +++ b/zlib/1.2.11/rezbuild.py @@ -38,7 +38,7 @@ def safe_extract(tar, path=".", members=None, *, numeric_owner=False): if not is_within_directory(path, member_path): raise Exception("Attempted Path Traversal in Tar File") - tar.extractall(path, members, numeric_owner) + tar.extractall(path, members, numeric_owner=numeric_owner) safe_extract(tar, build_path)