From faef4141abfae1a031daedff3a59964e3a9e202d Mon Sep 17 00:00:00 2001
From: TrellixVulnTeam <charles.mcfarland@trellix.com>
Date: Sat, 22 Oct 2022 05:15:30 +0000
Subject: [PATCH] Adding tarfile member sanitization to extractall()
---
.../node_modules/node-gyp/update-gyp.py | 21 ++++++++++++++++++-
.../node_modules/node-gyp/update-gyp.py | 21 ++++++++++++++++++-
2 files changed, 40 insertions(+), 2 deletions(-)
diff --git a/frontend/jupyter/node_modules/node-gyp/update-gyp.py b/frontend/jupyter/node_modules/node-gyp/update-gyp.py
index aa2bcb9eb..dd657c00e 100755
--- a/frontend/jupyter/node_modules/node-gyp/update-gyp.py
+++ b/frontend/jupyter/node_modules/node-gyp/update-gyp.py
@@ -34,7 +34,26 @@
print("Unzipping...")
with tarfile.open(tar_file, "r:gz") as tar_ref:
- tar_ref.extractall(unzip_target)
+ def is_within_directory(directory, target):
+
+ abs_directory = os.path.abspath(directory)
+ abs_target = os.path.abspath(target)
+
+ prefix = os.path.commonprefix([abs_directory, abs_target])
+
+ return prefix == abs_directory
+
+ def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+ for member in tar.getmembers():
+ member_path = os.path.join(path, member.name)
+ if not is_within_directory(path, member_path):
+ raise Exception("Attempted Path Traversal in Tar File")
+
+ tar.extractall(path, members, numeric_owner=numeric_owner)
+
+
+ safe_extract(tar_ref, unzip_target)
print("Moving to current checkout (" + CHECKOUT_PATH + ")...")
if os.path.exists(CHECKOUT_GYP_PATH):
diff --git a/frontend/kubeflow-common-lib/node_modules/node-gyp/update-gyp.py b/frontend/kubeflow-common-lib/node_modules/node-gyp/update-gyp.py
index aa2bcb9eb..dd657c00e 100755
--- a/frontend/kubeflow-common-lib/node_modules/node-gyp/update-gyp.py
+++ b/frontend/kubeflow-common-lib/node_modules/node-gyp/update-gyp.py
@@ -34,7 +34,26 @@
print("Unzipping...")
with tarfile.open(tar_file, "r:gz") as tar_ref:
- tar_ref.extractall(unzip_target)
+ def is_within_directory(directory, target):
+
+ abs_directory = os.path.abspath(directory)
+ abs_target = os.path.abspath(target)
+
+ prefix = os.path.commonprefix([abs_directory, abs_target])
+
+ return prefix == abs_directory
+
+ def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
+
+ for member in tar.getmembers():
+ member_path = os.path.join(path, member.name)
+ if not is_within_directory(path, member_path):
+ raise Exception("Attempted Path Traversal in Tar File")
+
+ tar.extractall(path, members, numeric_owner=numeric_owner)
+
+
+ safe_extract(tar_ref, unzip_target)
print("Moving to current checkout (" + CHECKOUT_PATH + ")...")
if os.path.exists(CHECKOUT_GYP_PATH):