unblob icon indicating copy to clipboard operation
unblob copied to clipboard

Resolve path traversal and unhandled permission error in tar handler

Open qkaiser opened this issue 3 years ago • 1 comments

Fixed path traversal in python's builtin tarfile module and added a privilege check when tarfile attempts to create device files.

This fixes #456 and #459

Brought to you by the excellent upstream connection on Thalys high speed train.

More info about traversal: https://davidhamann.de/2022/09/23/python-tarfile-vulnerability/

qkaiser avatar Oct 15 '22 17:10 qkaiser

Note: modifications to extract and _extract_member are preceded by a MOD: comment. The code was copied in place otherwise, and a the code complexity check had to be disabled.

qkaiser avatar Oct 15 '22 17:10 qkaiser