|
@@ -212,6 +212,22 @@ class BuildrootPackage():
|
|
|
self.filename = self.used_url['filename']
|
|
|
self.url = self.used_url['url']
|
|
|
|
|
|
+ def check_archive(self, members):
|
|
|
+ """
|
|
|
+ Check archive content before extracting
|
|
|
+
|
|
|
+ Keyword arguments:
|
|
|
+ members -- list of archive members
|
|
|
+ """
|
|
|
+ # Protect against https://github.com/snyk/zip-slip-vulnerability
|
|
|
+ # Older python versions do not validate that the extracted files are
|
|
|
+ # inside the target directory. Detect and error out on evil paths
|
|
|
+ evil = [e for e in members if os.path.relpath(e).startswith(('/', '..'))]
|
|
|
+ if evil:
|
|
|
+ print('ERROR: Refusing to extract {} with suspicious members {}'.format(
|
|
|
+ self.filename, evil))
|
|
|
+ sys.exit(1)
|
|
|
+
|
|
|
def extract_package(self, tmp_path):
|
|
|
"""
|
|
|
Extract the package contents into a directrory
|
|
@@ -233,6 +249,7 @@ class BuildrootPackage():
|
|
|
print('Removing {pkg}...'.format(pkg=tmp_pkg))
|
|
|
shutil.rmtree(tmp_pkg)
|
|
|
os.makedirs(tmp_pkg)
|
|
|
+ self.check_archive(as_zipfile.namelist())
|
|
|
as_zipfile.extractall(tmp_pkg)
|
|
|
pkg_filename = self.filename.split(".zip")[0]
|
|
|
else:
|
|
@@ -248,6 +265,7 @@ class BuildrootPackage():
|
|
|
print('Removing {pkg}...'.format(pkg=tmp_pkg))
|
|
|
shutil.rmtree(tmp_pkg)
|
|
|
os.makedirs(tmp_pkg)
|
|
|
+ self.check_archive(as_tarfile.getnames())
|
|
|
as_tarfile.extractall(tmp_pkg)
|
|
|
pkg_filename = self.filename.split(".tar")[0]
|
|
|
|