Merge branch 'master' into dev0.8.0

This commit is contained in:
x54-729 2022-10-06 10:15:06 +08:00
commit c083073e60

View File

@ -471,7 +471,26 @@ def untar_gz_file(file: Path, to: Path):
import tarfile import tarfile
with tarfile.open(file, 'r:gz') as tar: with tarfile.open(file, 'r:gz') as tar:
tar.extractall(to) def is_within_directory(directory, target):
abs_directory = os.path.abspath(directory)
abs_target = os.path.abspath(target)
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory
def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
for member in tar.getmembers():
member_path = os.path.join(path, member.name)
if not is_within_directory(path, member_path):
raise Exception("Attempted Path Traversal in Tar File")
tar.extractall(path, members, numeric_owner=numeric_owner)
safe_extract(tar, to)
def ungzip_file(file: str, to: str, filename: str): def ungzip_file(file: str, to: str, filename: str):